Rivano supports SAML 2.0 single sign-on (SSO) for organizations that need centralized identity management. Once configured, team members authenticate through your identity provider (IdP) and are automatically provisioned in Rivano.

Supported Providers

Provider	Protocol	Status
Okta	SAML 2.0	Supported
Azure AD (Entra ID)	SAML 2.0	Supported
Google Workspace	SAML 2.0	Supported
OneLogin	SAML 2.0	Supported
Custom SAML IdP	SAML 2.0	Supported

SAML Configuration

To set up SAML SSO, you’ll need to configure both your identity provider and Rivano. Start by navigating to Settings → Authentication → SAML SSO in the Rivano dashboard.

Rivano Service Provider Details

Provide these values to your identity provider:

Field	Value
ACS URL (Reply URL)	`https://app.rivano.ai/auth/saml/callback`
Entity ID (Audience URI)	`https://app.rivano.ai/saml/metadata`
Name ID Format	`urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`
Sign-on URL	`https://app.rivano.ai/auth/saml/login`

For self-hosted instances, replace app.rivano.ai with your deployment’s domain.

Identity Provider Details

After configuring your IdP, enter these values in Rivano:

Field	Description
IdP SSO URL	The sign-on URL provided by your IdP
IdP Entity ID	The issuer/entity ID from your IdP
IdP Certificate	The X.509 signing certificate (PEM format)

Provider-Specific Guides

Okta

In Okta Admin, go to Applications → Create App Integration
Select SAML 2.0
Enter the ACS URL and Entity ID from the table above
Set Name ID format to EmailAddress
Add attribute statements:
- email → user.email
- firstName → user.firstName
- lastName → user.lastName
Copy the IdP SSO URL, Entity ID, and download the certificate
Paste them into Rivano’s SAML settings

Azure AD (Entra ID)

In Azure Portal, go to Enterprise Applications → New Application
Select Create your own application → Non-gallery
Under Single sign-on → SAML, click Edit Basic SAML Configuration
Set:
- Identifier (Entity ID): https://app.rivano.ai/saml/metadata
- Reply URL (ACS): https://app.rivano.ai/auth/saml/callback
Under Attributes & Claims, ensure emailaddress is mapped
Download Certificate (Base64) and copy the Login URL
Enter these in Rivano’s SAML settings

Google Workspace

In Google Admin Console, go to Apps → Web and mobile apps → Add App → Add custom SAML app
Copy the SSO URL and download the Certificate
Enter the ACS URL and Entity ID from Rivano
Map attributes: email → Primary Email
Enable the app for your organizational unit
Paste the SSO URL and certificate into Rivano

Role Mapping

Rivano maps IdP groups to Rivano roles. Configure group-to-role mappings in Settings → Authentication → Role Mapping.

Rivano Role	Permissions	Suggested IdP Group
`owner`	Full access, billing, delete org	`rivano-owners`
`admin`	Manage agents, policies, users	`rivano-admins`
`member`	View dashboards, create agents	`rivano-members`
`viewer`	Read-only dashboard access	`rivano-viewers`

Attribute Mapping

Your IdP should send a groups or role attribute in the SAML assertion. Configure the attribute name in Rivano:

Attribute name: groups
Mapping:
  rivano-admins → admin
  rivano-members → member
  rivano-viewers → viewer

Users without a matching group are assigned the member role by default. You can change the default role in Settings.

Just-in-Time Provisioning

When JIT provisioning is enabled (default), users are automatically created in Rivano on their first SAML login. Their profile (name, email) and role are set from the SAML assertion attributes.

To disable JIT provisioning and require manual user creation, toggle Settings → Authentication → Auto-provision users off.

Enforcing SSO

Once SSO is configured and tested:

Go to Settings → Authentication → Enforcement
Enable Require SSO for all users
Optionally, set a grace period (e.g., 7 days) for existing password users to transition

After enforcement, password login is disabled and all authentication goes through your IdP. Organization owners retain emergency password access.

Troubleshooting

Issue	Solution
”Invalid SAML response”	Check that the ACS URL matches exactly (trailing slash matters)
User created with wrong role	Verify the `groups` attribute is included in the SAML assertion
Certificate error	Ensure the certificate is in PEM format and hasn’t expired
Login loop	Confirm the Entity ID matches between IdP and Rivano settings
Users can’t access after enforcement	Check the grace period hasn’t expired; owners can temporarily disable enforcement

SSO Setup