Enterprise Identity

Enterprise identity connects one company identity provider to one Moltern organization. Moltern supports SAML 2.0 and OpenID Connect for federated sign-in, plus SCIM 2.0 for directory provisioning.

Open Organization -> Security -> Identity to manage domains, identity providers, and directory tokens. These controls require an eligible organization plan and the Manage identity permission.

Rollout Order​

Use this order to avoid locking people out:

1. Verify the company domain.
2. Create the identity connection. It starts disabled.
3. Configure Moltern in the identity provider.
4. Run Check and resolve every reported issue.
5. Activate the connection.
6. Test sign-in with a pre-provisioned non-owner account.
7. Confirm that a recovery owner can still sign in without the managed domain.
8. Select Require SSO only after those tests pass. Moltern ends active sessions for people on the verified domains and immediately sends an affected administrator through the configured provider again.

Moltern permits one active identity provider per organization. Editing provider endpoints or credentials automatically disables the connection and clears its health result, so the updated configuration must be checked again.

Verify A Domain​

1. Select Domain in the Identity tab.
2. Enter a domain your organization controls.
3. Add the displayed TXT record at your DNS provider.
4. Return to Moltern and select Verify.

Domain verification proves ownership before Moltern uses the domain for sign-in discovery or enforcement. A verified domain cannot be removed while SSO is required.

Configure SAML 2.0​

Create The Connection​

1. Select Identity provider.
2. Choose SAML 2.0.
3. Enter a clear connection name.
4. Save the connection. The identity-provider metadata URL can be added after the service-provider values are registered.
5. Complete the protected security check.

The saved connection displays three public values:

Moltern value	Identity-provider field
Entity ID	Audience, identifier, or SP entity ID
ACS URL	Reply URL, callback URL, or assertion consumer service URL
SP metadata	Service-provider metadata URL or XML import

Open or copy the SP metadata URL when the identity provider supports metadata import. Moltern metadata contains the public signing certificate and never contains its private key.

Configure The Identity Provider​

Create a SAML application in the company identity provider, then:

1. Set the Entity ID and ACS URL exactly as shown by Moltern.
2. Configure signed SAML responses or assertions with SHA-256 or a stronger signature and digest algorithm.
3. Send the person's email address as the NameID or an email attribute.
4. Use the HTTP-Redirect or HTTP-POST sign-in binding.
5. Copy the provider's public HTTPS metadata URL.

Supported email attribute names include common email, mail, and standard email-address claim forms. Email matching is case-insensitive, but the asserted address must match the address that started sign-in.

Validate And Activate​

1. Return to the SAML connection and select Configure.
2. Add the identity-provider metadata URL.
3. Select Check.
4. Resolve any metadata, certificate, endpoint, or connectivity error.
5. Select Activate after the health state is healthy.

Moltern accepts only public HTTPS provider endpoints. Metadata must describe a SAML 2.0 identity provider, include a supported SSO endpoint, and contain a currently valid signing certificate. Saving a new metadata URL removes the previously validated provider metadata and requires another successful check.

Configure OpenID Connect​

Prepare the issuer URL, client ID, and client secret. After creation, the connection displays its exact Redirect URL with a copy action.

1. Select Identity provider.
2. Choose OpenID Connect.
3. Enter a clear connection name.
4. Enter the public HTTPS issuer URL and client credentials.
5. Complete the protected security check.
6. Copy the displayed Redirect URL into the provider's allowed callback list.
7. Run Check.
8. Activate the connection only after health succeeds.

The client secret is stored securely and is never returned in provider lists, audit exports, or browser responses. Moltern uses authorization-code flow with PKCE, state, and nonce validation.

The provider must supply a signed, verified email claim as well as a stable subject identifier. An email or username field alone does not prove ownership. If your provider does not supply a verified email claim, keep the connection disabled and check compatibility with Moltern support before rollout. Do not change claim mappings to manufacture verification. Test SAML and OpenID Connect separately, even when both use the same company directory.

Sign-In And Account Confirmation​

On the sign-in page, select Continue with organization SSO and enter a work email. Moltern discovers the active provider from the verified email domain and redirects the browser to it.

When SSO is required, password, Google, and GitHub sign-in for a managed-domain account are redirected to the organization provider. Social callbacks are checked before account linking or workspace creation. Existing GitHub repository access remains separate from account sign-in.

Enabling Require SSO revokes every active Moltern session belonging to users on the organization's verified domains in the same transaction as the policy change. This removes sessions created before enforcement. An affected administrator signs in again through the selected provider. Sessions for the separate recovery owner outside the managed domains remain available for recovery.

Moltern also re-evaluates this policy on every authenticated request. A password, Google, GitHub, or older untracked session cannot continue after required SSO becomes active, including when a sign-in races with the policy change. Switching to another authorized workspace preserves the SAML or OpenID Connect authentication method on the replacement session.

Sensitive organization actions can also be confirmed with the active organization provider. The temporary authentication window returns the confirmation to the original Moltern tab and closes when the provider flow completes. Moltern requests a fresh provider authentication for this confirmation instead of silently reusing the normal Moltern session.

Start and complete both sign-in and protected confirmation in the same browser. Keep the original Moltern tab open during the security check and permit Moltern cookies and the temporary provider window. If the request expires or is cancelled, restart it from Moltern; do not bookmark or reuse provider callbacks.

Existing Accounts And Provisioning​

SAML and OpenID Connect do not create an unapproved Moltern account. Before first enterprise sign-in, the person must already have:

• A Moltern user with the same verified email address.
• An active membership in the organization.
• Access to at least one workspace.

Invite people manually or provision them through SCIM. This prevents an identity-provider account from silently receiving application or workspace access.

Configure SCIM​

SCIM synchronizes organization people and groups. It does not silently grant workload permissions.

1. Create a directory token in the Identity tab.
2. Store the token when it is shown once.
3. Configure the provider with the Moltern SCIM base URL.
4. Test user creation, update, suspension, and removal.
5. Test group creation and membership changes.
6. Grant synchronized groups access separately from Organization -> Access.

Revoke a directory token during rotation or provider retirement. Deprovisioning removes inherited access while preserving the audit trail.

Certificate Rotation​

The SAML connection shows when its Moltern signing certificate expires. Rotate it before expiry:

1. Turn off Require SSO.
2. Disable the SAML connection.
3. Select Rotate certificate and complete the protected security check.
4. Re-import the updated SP metadata into the identity provider.
5. Run Check.
6. Activate and test the connection.
7. Require SSO again only after successful testing.

Rotation resets provider health and cannot run while the connection is active. If the identity provider rotates its own signing certificate, update its published metadata and run Check again so Moltern caches the validated certificate.

Disable an identity connection before deleting it. Removal invalidates unfinished sign-in attempts and deletes the connection credentials from secure storage.

Recovery And Security Boundaries​

• Keep an active organization owner with a password or linked social sign-in on an address outside all managed domains.
• SSO enforcement cannot be enabled until that recovery owner exists.
• Authentication requests and responses are bound to short-lived, one-time state.
• SAML authentication requests are signed; responses and assertions are signature-validated.
• SAML signature and digest algorithms must use SHA-256 or stronger; SHA-1 is rejected.
• Assertions must contain a matching audience, a request-bound bearer confirmation, and an authentication statement before Moltern creates a session.
• Encrypted SAML assertions are supported.
• Provider configuration changes and certificate rotation are protected and audited.
• Provider edits, validation results, activation, enforcement, domain removal, certificate rotation, and deletion are serialized. A validation result cannot activate configuration that changed while the check was running.
• The first transition to required SSO atomically revokes active sessions for verified-domain users. It preserves the outside-domain recovery owner, and saving an already-enforced connection does not revoke newly established enterprise sessions.
• Every request verifies that a managed-domain session was issued by SAML or OpenID Connect while required SSO is active. Workspace switching preserves that authentication method.
• Private, loopback, link-local, and internal provider endpoints are rejected.

Current SAML Boundaries​

• Sign-in is service-provider initiated from Moltern.
• Unsolicited identity-provider-initiated sign-in is not accepted.
• Global SAML single logout is not currently provided. Revoke Moltern sessions from Organization -> Security -> Sessions when immediate local sign-out is required.
• Role and workspace access are managed in Moltern; SAML attributes do not silently grant roles.

Troubleshooting​

Symptom	What to check
Domain remains pending	Confirm the exact TXT name and value, then allow for DNS propagation.
No organization sign-in is found	Confirm the email domain is verified and the connection is active.
Provider check fails	Review the actionable message, public HTTPS endpoints, metadata validity, and certificate dates.
SAML returns to sign-in	Confirm Entity ID, ACS URL, signed response settings, email claim, and matching user email.
Sign-in was not started in this browser	Restart from Moltern in the same browser and allow its cookies; an old or copied provider callback cannot complete a new request.
Security check keeps waiting	Keep the original tab open, allow the temporary window, use the linked account, and retry after a cancelled or expired request.
User is recognized but has no workspace	Invite or provision the person, then grant explicit workspace access.
Activation is blocked	Run a fresh successful check and disable any other active provider.
Require SSO is blocked	Add an active recovery owner outside the managed domains.
Sign-in fails after certificate rotation	Re-import Moltern SP metadata into the provider, then check and reactivate.
SCIM token no longer works	Check expiry or revocation and issue a replacement token.

Next: Review active access and protected actions.