Note: SSO & User Sync is currently only available in multi-tenant environments, i.e. at app.nuwacom.ai or app-de.nuwacom.ai. This feature is not currently available in single-tenant environments.
For single-tenant environments, integration is currently handled through a custom SSO setup. If you’d like to set up SSO for your environment, please contact us at support@nuwacom.ai. Our team will review your requirements and support you with the next steps.
For single-tenant environments, integration is currently handled through a custom SSO setup. If you’d like to set up SSO for your environment, please contact us at support@nuwacom.ai. Our team will review your requirements and support you with the next steps.
Prerequisites
To set this up, you need admin rights in nuwacom and access to your identity provider.Enable Single Sign-On
First, enable SSO and specify which email domains should sign in through your identity provider.- Open the workspace settings.
- Go to SSO & User Sync.
- Turn on the Enable SSO toggle.
- Under Email Domains, enter the domain for which SSO should apply.
- Then select the appropriate provider type to connect your identity provider to nuwacom via OpenID Connect (OIDC) or SAML 2.0.
OpenID Connect (OIDC)
If you select OpenID Connect (OIDC), enter your identity provider’s connection details. Enter the following values:
Example of a discovery URL:
SAML 2.0
If you select SAML 2.0, enter your identity provider’s metadata. You can enter the metadata in two ways:
Then copy the values shown in nuwacom and enter them in your identity provider:
Then click Save Configuration.
Advanced Settings
Here you define how external attributes from your identity provider are mapped to user attributes in nuwacom. Open this section and review the attribute mapping. By default, the following mappings are set, for example:
Click Add Mapping if you want to transfer additional attributes. Enter the external claim from your identity provider and map it to the appropriate user attribute in nuwacom.
Then select the appropriate sync mode:
Then click Save Configuration.
Enable SCIM User Sync
With SCIM, you automatically sync users from your identity provider to nuwacom.- Turn on the Enable SCIM User Sync toggle.
- Copy the displayed SCIM Endpoint URL and enter it in your identity provider.
- Click Generate Token to create a bearer token.
- Copy the bearer token and enter it in your identity provider for the SCIM connection.
Important: Treat the bearer token like a password. Do not share it publicly and store it only in secure locations.
Role Mapping
Here you define which IdP roles or IdP groups correspond to which workspace roles in nuwacom.- In the Role Mapping section, click Add Rule.
- Enter the name of the role or group from your identity provider.
If needed, click Add Fallback Rule to set a default role for all other users. Then click Save Rules.
Note: The first matching rule is applied. Users without a matching rule will not get access to the workspace if no fallback rule is defined.
Sync User Groups
If you’d also like to use SCIM groups as user groups in nuwacom, enable Synchronize SCIM Groups as User Groups. nuwacom will then automatically create and update user groups based on SCIM group memberships.Troubleshooting
SSO login isn't working. What should you check?
SSO login isn't working. What should you check?
Make sure the email domain is entered correctly and that SSO is enabled for this domain. Also check that the required values are configured exactly in your identity provider:
- For OIDC: Redirect URI
- For SAML: ACS URL and SP Entity ID
Users aren't being redirected to the identity provider. What could be causing this?
Users aren't being redirected to the identity provider. What could be causing this?
Check whether the user’s email domain is set up in nuwacom. Automatic redirection only works for users whose email domain matches a domain configured for SSO.
A user doesn't have access to the workspace. What should you check?
A user doesn't have access to the workspace. What should you check?
Check whether there is a matching role mapping for the user. If no mapping rule applies and no fallback rule is defined, the user will not get access to the workspace.
Users aren't being synced via SCIM. What should you check?
Users aren't being synced via SCIM. What should you check?
Make sure SCIM user sync is enabled. Also check whether the SCIM endpoint URL is entered correctly in your identity provider and whether the bearer token is still valid.
Groups aren't being imported as user groups in nuwacom. What should you check?
Groups aren't being imported as user groups in nuwacom. What should you check?
Check whether Synchronize SCIM Groups as User Groups is enabled. Also make sure that group memberships are correctly maintained in your identity provider and transferred via SCIM.
Changes from the identity provider don't appear in nuwacom. What should you check?
Changes from the identity provider don't appear in nuwacom. What should you check?
Synchronization is triggered by your identity provider. Check there whether the change was successfully sent to nuwacom. Also make sure that SCIM is active and the connection to nuwacom is working.
Attributes such as first name, last name, or email aren't imported correctly. What should you check?
Attributes such as first name, last name, or email aren't imported correctly. What should you check?
Open Advanced Settings and review the attribute mapping. Make sure the claims from your identity provider are mapped to the correct user attributes in nuwacom.