Let users sign in to Cloudmon using your organisation's identity provider. Supports Azure AD, Google, Okta, Keycloak, OAuth 2.0, and any generic OIDC-compliant provider.
SSO Integration lets users authenticate to Cloudmon through your organisation's existing identity provider (IdP) instead of a separate Cloudmon username and password. Cloudmon supports OpenID Connect (OIDC) based single sign-on, with dedicated setup flows for Azure AD, Google, Okta, and Keycloak, plus generic OAuth 2.0 and OIDC options for any other compliant provider.
Navigate to Settings → User Management → SSO Settings to configure SSO. This tab sits alongside User Roles, User Accounts, and User Groups.
The SSO Settings page is organized into four sections: Identity Provider, Connection Settings, User Provisioning, and Advanced Options.
Identity Provider: select the SSO provider and give it a display name.
| Field | Description |
| Provider* | Select the identity provider to integrate with: Azure AD, Google, Okta, Keycloak, OAuth 2.0, or Generic OIDC. The fields shown under Connection Settings change depending on the provider selected. |
| Display Name* | A friendly name for this SSO configuration, for example "Azure AD SSO", shown to users on the sign-in screen. |
Connection Settings: credentials from your identity provider's app registration. The fields required here depend on the Provider selected above.
| Field | Description |
| Tenant ID* | Azure AD only. The Azure AD tenant identifier (GUID) for your organisation's directory. |
| Okta Domain* | Okta only. Your Okta org domain, for example dev-12345.okta.com. |
| Base URL* / Realm* | Keycloak only. Base URL is your Keycloak server address, for example keycloak.your-domain.com. Realm is the Keycloak realm configured for Cloudmon, for example master. |
| Client ID* | All providers. The application (client) ID from the app registration created in your identity provider. |
| Client Secret* | All providers. The client secret value generated for the app registration. Hidden by default; click the eye icon to reveal it. |
| Issuer URL* | All providers. Auto-generated based on the Provider and, where applicable, the Tenant ID, Okta Domain, or Base URL entered above (e.g. https://accounts.google.com for Google). For Generic OIDC, this must be entered manually. |
| Redirect URI* | All providers. Auto-generated by Cloudmon. Click the copy icon and paste this URL into your identity provider's app registration as the allowed redirect/callback URL. |
User Provisioning: control how SSO users are created and what access they get.
| Field | Description |
| Default Role* | The Cloudmon user role automatically assigned to a user the first time they sign in via SSO, unless overridden by a Group Mapping under Advanced Options. |
| Default Groups | Choose All Groups to give SSO users access across all groups by default, or Select Groups to restrict newly provisioned SSO users to specific groups. |
Advanced Options: custom scopes and IdP group-to-role mapping.
| Field | Description |
| Scopes | The OIDC scopes requested during sign-in. openid, email, and profile are included by default. Type a scope name and click Add to request additional scopes your identity provider supports. |
| Group Mapping | Click Add Mapping to map a group or claim from your identity provider to a specific Cloudmon role, overriding the Default Role for users in that IdP group. If no mappings are configured, every SSO user is assigned the Default Role. |
Click Save to enable SSO with the configured provider. Use Reset to discard unsaved changes.
Regardless of which provider is selected, the same general setup pattern applies: create an app registration (or equivalent) in the identity provider, copy its Client ID and Client Secret into Cloudmon, then copy the auto-generated Redirect URI from Cloudmon back into the identity provider's allowed redirect URLs.
| Symptom | Likely Cause | Fix |
| "Redirect URI mismatch" or similar error during sign-in | The Redirect URI was not added, or was added incorrectly, to the identity provider's app registration | Copy the Redirect URI shown in Connection Settings using the copy icon and add it exactly as shown to the allowed redirect URLs in the identity provider |
| Authentication fails with an invalid client error | The Client ID or Client Secret is incorrect, or the secret has expired | Re-check the Client ID and Client Secret against the identity provider's app registration, generating a new secret if it has expired |
| SSO users sign in but have the wrong access level | No Group Mapping exists for the user's IdP group, so they were assigned the Default Role instead | Add a Group Mapping under Advanced Options for the relevant IdP group, or adjust the Default Role if it should apply more broadly |
| SSO users cannot see groups they expect to have access to | Default Groups is set to Select Groups and the user's relevant group was not included | Update Default Groups to include the missing group, or switch to All Groups if broader access is intended |
| Generic OIDC connection fails immediately | The Issuer URL was entered incorrectly, since it must be typed manually for Generic OIDC and is not auto-generated | Confirm the Issuer URL matches the identity provider's OIDC discovery endpoint exactly |