SAML SSO

Single sign-on (SSO) allows users of your Cryptlex account to log in using your existing SAML-enabled identity provider, such as Active Directory, OneLogin, Auth0, and Okta. This reduces the number of passwords your users need to manage and simplifies provisioning new users.

SAML SSO can be configured at two levels:

Account level: Your team members configure SAML SSO for your Cryptlex account using your identity provider, covering admin portal login and, through role mapping, customer and reseller portal login.
Organization level: An organization admin can configure SAML SSO for their own organization from the customer portal, so the organization's users log in to the customer portal with the organization's own identity provider.

Configuring account-level SAML SSO

To get started, go to the Settings -> Account page in the admin portal and click the Configure SAML SSO button. This displays the SAML SSO settings dialog where you can add details of your identity provider.

Cryptlex supports the SAML 2.0 standard. Each identity provider has its own interface and nuances, but most provide configuration metadata as a URL, so this article covers configuration with a generic SAML identity provider.

The easiest way to configure SSO is to use a link to your identity provider's metadata file. Enter the URL in the SAML IdP Metadata URL input box and click Save. Cryptlex downloads the configuration file, parses it, and configures everything.

Auto-provisioning users

The SAML identity provider must be configured to provide four attributes: Email, FirstName, LastName, and Role. These attributes allow Cryptlex to identify and automatically provision users.

FirstName, LastName, and Role are only required if the auto-provisioning of users is enabled.

Enter the attribute names your identity provider sends in the Email Attribute, First Name Attribute, Last Name Attribute, and Role Attribute fields in the SAML SSO settings dialog. Each field accepts multiple attribute names separated by commas, matched case-insensitively.

If you leave these fields empty, Cryptlex falls back to well-known attribute names, including the standard SAML claim URIs (for example, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress) and common names like Email, FirstName, LastName, and Role.

If the IdP sends more than one role, Cryptlex applies a predefined priority order to determine the effective role for that session.
Priority order (highest to lowest): admin, organization-admin, reseller-admin, user.

Role mapping

You can map the roles created in Cryptlex (service provider roles) to your existing roles in the identity provider. Depending on the identity provider role in the SAML assertion, Cryptlex uses the corresponding service provider role when auto-provisioning the user.

Ensure that the roles are correctly mapped in your Cryptlex SSO settings.
Team members must log in through the admin portal, customers (including users and organization admins) must access the customer portal, and reseller admins must use the reseller portal.
For the correct portal URLs, go to the Settings -> Customizations page in the admin portal.

Configuring organization-level SAML SSO

Organization admins can set up SAML SSO for their organization from the customer portal, using the organization's own identity provider. Once configured, users belonging to the organization authenticate against that identity provider when logging in to the customer portal, instead of using Cryptlex credentials or your account-level identity provider.

Google SSO Deprecations

Last updated: 8/19/2026