SSO & Identity Federation

Integrate with your existing identity provider. SAML 2.0 and OIDC available on Business tier. Active Directory and LDAP sync available on Enterprise and above.

Capabilities

• SAML 2.0 and OIDC support
• LDAP / Active Directory sync
• MFA enforcement policies

Supported Identity Providers

Protocol	Examples
SAML 2.0	Okta, Azure AD, Google Workspace, OneLogin, Ping Identity
OIDC	Auth0, Okta, Azure AD, Google Workspace, Keycloak
LDAP / Active Directory	On-premise AD, OpenLDAP, FreeIPA

How It Works

sequenceDiagram
  participant U as User
  participant AB as AgentBrain
  participant IdP as Identity Provider
  U->>AB: Click Sign In
  AB->>IdP: SAML AuthnRequest
  IdP->>U: Login prompt + MFA
  U->>IdP: Credentials
  IdP->>AB: SAML Response with claims
  AB->>AB: Map groups to roles
  AB->>U: Session established

Group-to-Role Mapping

AgentBrain reads group claims from the SSO assertion and maps them to internal roles. Example:

SSO Group	AgentBrain Role
engineering-admins	Engineering Admin
support-agents	Support Agent role
executives	Read-only Executive

When a user is removed from an SSO group, their AgentBrain role is revoked on the next session refresh.

LDAP / AD Sync

For environments without modern SAML or OIDC, AgentBrain syncs users and groups from LDAP or Active Directory on a configurable interval. Changes propagate to RBAC automatically.

MFA Enforcement

MFA enforcement is delegated to the identity provider. AgentBrain trusts the IdP's MFA decision encoded in the assertion. For organizations without MFA at the IdP, AgentBrain provides a TOTP fallback (Enterprise tier and above).

Tier Availability

Tier	SSO Features
Starter	Not included
Business	SSO with company domain login
Enterprise	SAML 2.0, OIDC, LDAP / AD sync, MFA policies
Custom	Enterprise features + custom identity rules

Related

• RBAC for role assignment after SSO
• SOPs: RBAC Setup