SSO setup

Single sign-on (SSO) connects Rival Enterprise directly to your organization’s identity provider. Team members log in using their standard corporate credentials, ensuring platform access remains tied to your central employee directory rather than managed through individual logins.

Key benefits

• Centralized access management — authentication is governed by your primary corporate directory. When an employee departs and IT disables their primary account, platform access terminates immediately.
• Simplified access — team members log in with their existing enterprise credentials, removing the need to manage separate passwords or request reset tickets.
• Streamlined IT administration — account creation, password resets, and session revocations are handled centrally within your existing identity stack.

Setting up your identity provider

Connecting Rival Enterprise to your identity provider involves a standard metadata exchange to establish trust between both systems. Rival integrates natively with SAML 2.0 and OIDC identity providers.

1. Retrieve Rival’s configuration details — copy the Assertion Consumer Service (ACS) URL and Entity ID from the Rival admin console.

2. Create the application entry — create a new application in your identity provider’s portal using those details.

3. Link metadata — provide your identity provider’s metadata URL or XML certificate to Rival to validate the connection.

4. Verify email domains — register your organization’s email domains (such as company.com) to automatically route matching user sign-ins through your SSO flow.

Authentication vs. workspace permissions

SSO confirms a user’s identity, while Rival workspace roles determine what they can access once authenticated:

• Identity provider — verifies who the user is and manages whether their account is active.
• Rival role engine — controls platform permissions, including creating agents, adjusting budgets, or managing security policies.
• Group mapping — user groups in your identity provider can map directly to Rival platform roles, automatically assigning appropriate permissions upon first login.

For what each role can do once signed in, see the Capability matrix.

A quick example: Okta employee lifecycle

Consider an enterprise managing platform access through Okta:

1. Onboarding — a new hire is assigned to the Rival user group in Okta. Upon logging in, they are provisioned into the workspace with the permissions designated for their team.
2. Offboarding — when the employee leaves, IT deactivates their Okta profile. Access to Rival, including active sessions and tokens, is revoked automatically without manual cleanup inside the workspace.

Architecture overview

Layer	Responsible system	Function
Authentication	Enterprise identity provider	Verifies identity and maintains user status
Federation	SAML 2.0 / OIDC	Securely passes signed authentication tokens
Authorization	Rival workspace settings	Enforces role permissions and administrative guardrails

Next steps

• Configure user boundaries and roles → Roles overview
• Set up automated directory provisioning → User lifecycle
• Manage general workspace defaults → Account settings