Skip to main content

SSO & MFA Patterns

Use this guide to review cross-provider SSO and MFA patterns in Cloudaware, including group and role mapping, testing, break-glass access, and MFA policies.

Where To Start​

Before configuring SSO, confirm who can administer Cloudaware access, how RBAC is modeled, and which SSO setup path applies to your identity provider.

Provider-Specific Setup Guides​

Use these setup guides when you are ready to configure SAML settings, claims, certificates, and login behavior for a specific identity provider.

Common Configuration Steps​

  • Choose protocol and flow.
    • Use SAML for typical enterprise SSO and broad IdP support.
    • Use OIDC if your target app and policies require it.
  • Decide how identities map.
    • Confirm that the user identifier, usually email or username, matches Cloudaware/Salesforce user records.
    • Confirm that group claims, or equivalent attributes, are available at login time.
  • Define authorization mapping.
    • Map IdP groups to Salesforce permission sets, permission set groups, or profiles by persona.
    • Keep a small set of coarse-grained access groups; use permission sets for fine-grained module access.
  • Plan lifecycle management.
    • Define joiner, mover, and leaver workflows for group assignment and deprovisioning.
    • Define the Just-In-Time (JIT) provisioning policy, if used, including who can be created.
  • Validate time settings and certificates.
    • Confirm NTP and clock skew tolerance.
    • Monitor SAML signing certificate expiration, rotation, and metadata updates.g

MFA & Session Policies​

  • Enforce MFA for privileged roles and administrators at the IdP and/or platform level
  • Prefer shorter sessions for privileged roles; require re-auth for sensitive actions
  • Audit and alert on RBAC/SSO changes (group mapping, permission sets, SSO config)

Break-Glass & Failover​

  • Maintain at least one non-SSO admin account (stored and monitored as emergency access)
  • Document failover procedure (who can disable SSO enforcement; how to regain access)
  • Test break-glass quarterly (tabletop + controlled login test)

Troubleshooting​

  • Troubleshooting includes:
    • Role mismatch: wrong group claim, wrong mapping, user missing group, stale sessions
    • Login failures: attribute mismatch, clock skew, cert issues, incorrect endpoints/metadata