LiveEnterprise SSO
OIDC live for Enterprise SSO-entitled workspaces; SAML SSO and SCIM remain Q4 roadmap-labeled
SAML SSO
SAML SSO is Q4 roadmap. Do not describe it as included, purchasable, or externally configurable until the rollout is approved and customer setup evidence is published.
Roadmap scope
- SAML 2.0 support for Enterprise SSO-entitled workspaces.
- Enterprise-led metadata validation and test sign-in before tenant-wide enforcement.
- Break-glass owner/admin recovery planning before enforcement.
Customer inputs
| Input | Purpose |
|---|---|
| IdP entity ID | Issuer validation |
| IdP SSO URL | Redirect destination for SP-initiated sign-in |
| X.509 certificate | Assertion signature validation |
| Email claim mapping | Match IdP identity to Cadence user email |
Planned configuration path
- Confirm the workspace is entitled for Enterprise SSO.
- Keep one customer-owned break-glass owner/admin account outside routine IdP policy changes.
- Collect the IdP entity ID, SSO URL, X.509 certificate, and email claim mapping.
- Wait for the Q4 SAML rollout before entering provider details or enabling enforcement.
- Validate metadata and complete a test sign-in before any future tenant-wide enforcement.
Boundary
SCIM provisioning is roadmap-labeled and should not be described as live account provisioning. SAML does not imply JIT provisioning, SCIM lifecycle sync, or local-password blocking unless those controls are separately enabled and verified for the tenant.