Single Sign-On for the TechWolf Console

This page describes SSO for the TechWolf Console. It does not apply to API authentication. For API access, see Authentication in the Tutorials.

With Single Sign-On (SSO), your employees can log in to the TechWolf Console using your company’s existing identity provider (IdP) instead of separate credentials. This simplifies access management and aligns with your existing security policies.

Use this page as your reference while setting up and reviewing the connection. It lists the supported providers, the exact values your IdP admin needs (ACS URL, entity ID, application URL, attributes), and the answers to the questions that usually come up during setup and security review, so you can configure SSO and clear your security review without contacting us.

Supported SSO Providers

TechWolf supports the following SSO providers for the TechWolf console:

Provider
Generic OIDC
Generic SAML
Okta Workforce Identity (using OIDC)
Entra ID
Google Workspace (using OIDC)
Keycloak
Microsoft Active Directory Federation Services (ADFS)
PingFederate

Where each value goes

SSO connects two sides, and each side needs values from the other:

Where you enter it	What you enter	Where you find it
The SSO setup flow in the Console	Values about your IdP: its sign in URL (PingFederate calls it the server URL), metadata URL or signing certificate	Your IdP
Your IdP	Values about TechWolf: ACS URL, SP entity ID, application URL, relay state, email attribute	The tables on this page

How your values are built

Every TechWolf value is built from three things: your tenant name, your region, and the environment (production or staging).

Your tenant name is the first part of your Console URL. If your Console is at https://yourcompany.console.techwolf.ai, your tenant name is yourcompany.

The table below shows the parts that depend on your region. The next section puts them into each field.

Region	Auth0 tenant	Auth domain
EU	techwolf	eu3.auth.techwolf.ai
US	techwolf-us	us3.auth.techwolf.ai
CA	techwolf-ca	ca1.auth.techwolf.ai

Setting up the connection (for your IdP / IT admin)

Field	Template	EU, production	US, production	CA, production	EU, staging
Protocol	SAML 2.0	SAML 2.0	SAML 2.0	SAML 2.0	SAML 2.0
ACS / callback URL (also recipient, destination)	https://<auth-domain>/login/callback	https://eu3.auth.techwolf.ai/login/callback	https://us3.auth.techwolf.ai/login/callback	https://ca1.auth.techwolf.ai/login/callback	https://eu3.auth.techwolf.ai/login/callback
SP entity ID	urn:auth0:<auth0-tenant>:<tenant>-sso	urn:auth0:techwolf:<tenant>-sso	urn:auth0:techwolf-us:<tenant>-sso	urn:auth0:techwolf-ca:<tenant>-sso	urn:auth0:techwolf:<tenant>-staging-sso
Application URL (also sign-in URL)	your Console URL	https://<tenant>.console.techwolf.ai	https://<tenant>.console.techwolf.ai	https://<tenant>.console.techwolf.ai	https://<tenant>-staging.console.techwolf.ai
Relay state	/	/	/	/	/
IdP metadata URL	enter your IdP’s metadata URL in the setup flow	(from your IdP)	(from your IdP)	(from your IdP)	(from your IdP)

Replace <tenant> with your own tenant name in every value. Do not copy the values with <tenant> still in them. If your Console is at https://yourcompany.console.techwolf.ai, the US production SP entity ID is urn:auth0:techwolf-us:yourcompany-sso.

The application URL is the URL of your Console. Some IdPs label this field “sign-in URL”; it is the same value.

Required attributes

Attribute	Expected format	Example
email	A valid email address. SAML NameFormat: unspecified (any format accepted).	[e-mail]

We use email to link the SSO user to their Console account, so it must be present. username is optional and can be any format.

Additional SAML settings

• Login type: SP-initiated only (IdP-initiated is not supported). See Login must start from the Console.
• Request signing: supported. Algorithm RSA-SHA256, digest SHA256, binding HTTP-POST.
• Signing certificate: X.509 (.pem or .cer).
• Assertion encryption: optional. Supported as a per-connection configuration and enabled when your organisation requires it; off by default.
• Logout: SP-initiated logout ends the user’s Console session and returns them to the Console. SAML Single Logout (SLO) is not supported.

Login must start from the Console

We only support SP-initiated login. Your users open the Console URL, click the SSO button and are sent to your IdP. Login that starts from your IdP (IdP-initiated), such as clicking an app tile in the Microsoft or Okta portal, does not work.

Check this when you fill in the sign in URL of your IdP in the setup flow. It must be the URL that accepts a login request from TechWolf, not a URL that starts a login on its own. For PingFederate:

URL ends with	Login type	Use it?
/idp/SSO.saml2	SP-initiated	Yes
/idp/startSSO.ping	IdP-initiated	No, login will fail

/idp/ in the URL is fine. It only means the URL points to your IdP server.

Security and architecture review

Question	Answer
Identity management system	OAuth 2.0 (Auth0)
Authentication protocol	OIDC with federated SAML 2.0 for enterprise SSO
Authorization method	Role-based access control (RBAC)
Supported identity providers	Generic OIDC, Generic SAML, Okta Workforce Identity, Entra ID, Google Workspace, Keycloak, Microsoft ADFS, PingFederate
Hosting regions	EU, US, CA

User provisioning and access

Question	Answer
How are accounts created?	Manually today (CSV upload). SCIM auto-provisioning is on the roadmap.
How is access granted?	Add users to a group in your IdP that has access to the connection.
Separate test and production SSO?	Yes, a separate connection per environment.

Next Steps

To set up SSO for your organisation, follow the steps on the user management page of the Console or contact your TechWolf account manager or [e-mail]. You can only set up one SSO connection per Console.