Skip to documentation content
CookieBeam

Single sign-on and SCIM

Let team members sign in through your identity provider with SAML or OpenID Connect, require SSO, keep break-glass owners, and provision members with SCIM.

Enterprise SSO and SCIM directory sync are part of the Enterprise plan. On other plans the SSO page shows an upgrade notice instead of the settings, and the server refuses SSO and SCIM changes.

Only the team owner can change SSO and SCIM settings. Open SSO in the dashboard sidebar.

1. Verify your email domains

SSO and SCIM can only sign in or create members whose email address is on a domain you have verified.

  1. Under Verified Domains, enter your domain, for example example.com.
  2. Add the TXT record shown to your DNS.
  3. Select Check DNS. The status changes from Pending to Verified once the record is found.

Repeat this for each email domain your staff use.

2. Connect your identity provider

CookieBeam supports SAML 2.0 and OpenID Connect (OIDC).

For SAML:

  1. Enter a connection name.
  2. Enter your identity provider's metadata URL, or paste its metadata XML.
  3. Save. CookieBeam then shows the Callback / ACS URL and the SP-initiated sign-in URL.
  4. Add the ACS URL to the application in your identity provider.

For OIDC:

  1. Enter a connection name.
  2. Enter the OpenID Connect discovery URL, the client ID and the client secret.
  3. Save, then copy the Redirect URI into your identity provider.

Turn on the connection's Enable SSO switch to let members sign in through the connection. Allow IdP-initiated sign-in lets people start from your identity provider's dashboard. Leave it off unless your provider needs it, because sign-in started from CookieBeam is the safer flow.

What happens when someone signs in

  • An invited person joins with the permissions in their invitation.
  • An existing member signs in as usual.
  • A new person from a verified domain, with no invitation, is added as an Editor with no banner access. An owner or admin then gives them access to banners.
  • An existing CookieBeam user who is not a member of your team is refused until someone invites them.

New members created by SSO count toward your plan's member limit. When the team is full, sign-in for new people is refused.

Require SSO

Turn on Require SSO to make members sign in through your identity provider. An enabled SSO connection is needed first.

While SSO is required, password sign-in is blocked for everyone except break-glass owners:

  • Break-glass owners are owners who can still sign in with a password and two-factor authentication, so an identity-provider outage cannot lock the team out.
  • Only owners with two-factor authentication enabled can be designated.
  • Every break-glass sign-in is logged and emailed to all owners.

Designate at least one break-glass owner before you require SSO. If none is designated and your identity provider fails, nobody on the team can sign in.

SCIM directory sync

SCIM lets your identity provider add and remove team members automatically.

  1. Under SCIM Directory Sync, enter a directory name and turn on Enable SCIM.
  2. Save. CookieBeam shows the SCIM endpoint and a Bearer token.
  3. Copy the token now. It is shown only once.
  4. Enter the endpoint and token in your identity provider's SCIM settings.

When your identity provider deactivates or deletes a user, CookieBeam removes them from the team and revokes their access. If that was their only team, their CookieBeam user is deactivated too. New users from a verified domain are added as Editors unless they have a pending invitation. The page shows the number of connected users and the time of the last sync.

To replace the token, select Rotate. The old token stops working immediately, so your identity provider stops syncing until you paste the new one.

Related