SSO & Role Mapping
xlnszia supports SAML 2.0 SSO (Microsoft Entra ID), automatic (JIT) provisioning of new
users, SAML role mappings and SCIM 2.0 user provisioning. Configure
everything under Settings → Authentication (permission sso.manage).
1. Microsoft Entra ID application (Azure portal)
| Field | Value |
|---|---|
| Identifier (Entity ID) | xlnszia (matches sso_entity_id) |
| Reply URL (ACS) | https://api.xlnszia.com/api/v1/auth/sso/acs |
| Sign-on URL | https://api.xlnszia.com/api/v1/auth/sso/login |
| Logout URL | https://app.xlnszia.com/logout |
| Name identifier | userPrincipalName |
| Attributes | email, displayName, groups |
2. Settings to enter in the app
| Field | Value |
|---|---|
| Provider | Microsoft Entra (Azure AD) |
| SP Entity ID | xlnszia |
| IdP Entity ID (Issuer) | https://login.microsoftonline.com/<tenant-id>/ |
| SSO entry point | https://login.microsoftonline.com/<tenant-id>/saml2 |
| IdP signing certificate | Download the Base64 cert from Entra and paste |
| NameID format | Email address |
| Auto-provision users | ON (JIT) |
| Session timeout / Idle timeout | 480 (8h) / 30 minutes |
| Allowed IP ranges | Corporate CIDRs (enforced by Entra Conditional Access) |
| Require MFA for admins | ON (Entra Conditional Access policy) |
3. Roles
Permissions are enforced per resource (tests, alerts, dashboards, users, teams, integrations, audit, governance, SSO, ...). Seeded roles:
| Role | Purpose |
|---|---|
| Admin (system) | Full access (all permissions) |
| Manager (system) | Manage tests, rules and alerts |
| Viewer (system) | Read-only |
| Team Admin | Manage team members/settings + all test and alert operations |
| Test Creator | Create tests; cannot edit or delete |
| Test Approver | Approve test changes (tests.approve) |
| Dashboard Editor | Create / edit dashboards (dashboards.edit) |
| Report Viewer | View reports (reports.view) |
| Alert Manager | Manage alert rules + acknowledge alerts |
| Integration Manager | Configure integrations (DevOps) |
| Monitor | Acknowledge alerts + view status |
| Auditor | Read-only + audit logs (create via Governance → Roles) |
Custom roles can be created under Governance → Roles (GET/POST/PUT /api/v1/roles). Permissions are reflected in the UI (navigation and action
buttons) and enforced on every API endpoint.
4. SAML role mapping (Entra groups → app roles)
In Settings → Authentication → SAML role mappings, map an IdP attribute value
(group name or Object ID) to an app role. The first active match wins; Entra's full group claim URI also
matches the short attribute name (groups).
| Entra group | App role |
|---|---|
| Team Admins | Team Admin |
| Test Engineers | Test Creator |
| QA Team | Test Approver |
| Reporting Team | Report Viewer |
| Alert Responders | Alert Manager |
| DevOps | Integration Manager |
| Global Admins | Admin |
5. SCIM provisioning
- Enable SCIM in Authentication settings and set a bearer token (stored hashed — never returned by the API).
- In Entra, add a SCIM provisioning connection:
- Tenant URL:
https://api.xlnszia.com/api/v1/scim/v2 - Secret token: the bearer token you set
- Tenant URL:
- Auto-sync every 4 hours; supported operations: Create, Update, Delete User
(
POST/PUT/PATCH/DELETE /api/v1/scim/v2/Users). - SCIM
rolesarray entries map to app roles by name (e.g.{"value": "Monitor"}).
6. Security checklist
- MFA enforced via Entra Conditional Access for the app.
- Session timeout 8h, idle 30 min.
- IP restrictions: corporate ranges only.
- Alert on suspicious sign-ins (Entra sign-in logs → SIEM).
- Keep the local
adminaccount as the break-glass account; do not remove it.
Break-glass account
admin account — it is the fallback if the IdP becomes unreachable.