API documentation

Single sign on

Where single sign on (SSO) stands today, on one page. SSO is designed and the sign in gate behind it is in place. No identity provider has been connected in production yet. SAML itself is enabled with the first customer who asks for it, and until then every workspace signs in as described below.

What works today

  • Every user signs in with a work email and a password, or with a one time sign in link sent to the work email.
  • Users are provisioned by arrangement with your administrator and hold one of four roles, as described under Enterprise onboarding.
  • API keys are separate from user sign in. They are minted by a workspace admin and are covered under Keys and access management.

What is designed

None of the following is live for any workspace today. It describes how SSO is built to behave once a federation is set up.

  • SAML 2.0 federation to Microsoft Entra ID, with the sign in started from the Stonewake login page.
  • Your identity provider is meant to keep control of credentials, multi factor authentication and conditional access. Stonewake would receive a signed assertion and never a password.
  • A first sign in through SSO is designed to create the account and grant nothing. This part is in place and tested today, because the API already refuses every request from an account that has no assigned role and team, however it signed in. Access to data is always an explicit grant, never a side effect of being in your directory.
  • Each role assignment is designed to be written to the audit trail of your workspace.

How it gets switched on

  • Tell your named contact that you want SSO. We then enable SAML, exchange federation metadata with your identity team and agree the email domains that belong to your workspace.
  • We test the federation with one account of yours before anyone else is moved.
  • Password sign in stays available alongside SSO for the accounts that already have one, so nobody is locked out during the move.

What we do not offer today

  • The setup is designed for Microsoft Entra ID. No identity provider has been connected in production yet. If you run another SAML 2.0 provider, ask us before you plan around it.
  • There is no self service SSO setup in the dashboard. Setup runs through your named contact.
  • Automatic user provisioning and removal over SCIM is not available. A leaver is cut off by removing them in your identity provider, by our removing the account, or by both.
  • SAML single logout is not supported. Signing out of Stonewake ends the Stonewake session, and session lifetimes are bounded and agreed with you.
  • Group membership would not grant roles automatically. Your groups would be recorded at sign in, and an administrator would use them when granting or reviewing roles.

Questions go to contact@stonewake.ai. See also the Security overview and Enterprise onboarding.