Identity Provider Integration (SSO/SAML)

Seamless Integration with Your Identity Infrastructure

Enterprise collaboration tools must fit into existing identity and access management infrastructure. Requiring users to manage yet another set of credentials is not merely inconvenient — it is a security liability. Forgotten passwords, credential reuse, and ungoverned access all increase attack surface.

Mandraki supports integration with your organisation’s identity provider (IdP) through industry-standard protocols, enabling single sign-on, automated user provisioning, and centralised access governance.

Supported Protocols

SAML 2.0

Mandraki acts as a SAML Service Provider (SP), integrating with any SAML 2.0-compliant Identity Provider. This includes Microsoft Entra ID (formerly Azure AD), Okta, OneLogin, Ping Identity, Keycloak, and ADFS.

Configuration requires exchanging metadata between your IdP and Mandraki. Once configured, users authenticate through your IdP’s login flow and are redirected to Mandraki with a signed assertion. Mandraki validates the assertion, provisions or updates the user record, and establishes a session.

OpenID Connect (OIDC)

For organisations that prefer OIDC, Mandraki supports the Authorization Code flow with PKCE. This is particularly relevant for organisations using modern identity platforms or custom-built authentication services that expose OIDC endpoints.

Mandraki as Your Identity Provider

Mandraki can also be the identity provider for your other systems. It is a standards-compliant OpenID Connect provider: any application that offers “sign in with Okta”, “sign in with Microsoft” or generic OIDC login can be pointed at Mandraki instead, so your HR, time-reporting or ticketing tools use the same accounts, the same MFA policy and the same session controls as Mandraki itself.

Administrators register each application in the Security Center, choose which claims it receives (identifier, name, email, organisation role), and can rotate its credentials or revoke it at any time. Discovery, signing keys and user information are published at the standard endpoints, so integration is a matter of entering the issuer URL and a client ID. All identity data stays on Mandraki’s EU infrastructure.

Automated User Provisioning

Just-in-Time (JIT) Provisioning

When a user authenticates via SSO for the first time, Mandraki automatically creates their account and assigns them to the correct organisation based on the identity attributes in the SAML assertion or OIDC claims. No manual account creation is required.

Attributes mapped from the IdP typically include:

• Email address (required)
• Display name
• Department or group membership
• Role (mapped to Mandraki roles: Owner, Admin, or Member)

SCIM Provisioning

For organisations that require lifecycle management — creating accounts before first login, updating attributes, and deactivating accounts when employees leave — Mandraki supports the SCIM 2.0 protocol. Your IdP pushes user and group changes to Mandraki’s SCIM endpoint, keeping the user directory synchronised automatically.

This ensures that when an employee is offboarded in your IdP, their Mandraki access is revoked immediately, without waiting for an administrator to remember to disable the account manually.

Domain Verification and Auto-Capture

Organisations can claim and verify their email domain within Mandraki. Once verified, several powerful governance features become available.

Auto-capture. New users who sign up with an email address matching your verified domain are automatically added to your organisation, rather than creating a standalone personal account. This prevents shadow IT — users adopting Mandraki outside your organisation’s governance.

Block personal signup. You can prevent users with your domain from creating personal accounts entirely, ensuring that all usage of Mandraki by your employees is within your managed organisation.

DNS verification. Domain ownership is verified by adding a TXT record to your domain’s DNS. This is a one-time setup that provides ongoing governance control.

Multi-Organisation Support

Mandraki’s identity model supports users who belong to multiple organisations. A consultant who works with three clients, each with their own Mandraki organisation, can switch between them without logging out and back in. The SSO integration respects this model — each organisation can have its own IdP configuration, and users authenticate against the appropriate IdP for each organisation.

Security Considerations

No password storage for SSO users. When SSO is enabled, Mandraki does not store passwords for federated users. Authentication is delegated entirely to your IdP, and Mandraki only stores the external identifier and mapped attributes.

Enforced SSO. Organisations can require that all members authenticate via SSO, preventing the use of email/password login. This ensures that your IdP’s authentication policies — multi-factor authentication, conditional access, session duration — apply consistently.

Session management. Mandraki issues its own JWT tokens after SSO authentication, with configurable expiry. When a user’s IdP session is revoked, their Mandraki session expires at the next token refresh, ensuring timely access revocation.

Getting Started

Configuring SSO typically takes less than thirty minutes. Your IT administrator adds Mandraki as a SAML or OIDC application in your IdP, exchanges metadata, and enables SSO in the Mandraki organisation settings. Detailed configuration guides for each major identity provider are available in our knowledge base.