Skip to main content

SSO Setup Overview

R
Written by Roy Turiski

Single Sign-On (SSO)

Bagel AI supports secure authentication via:

  • Google Sign-In (OAuth 2.0)

  • Optional SAML 2.0 SSO (for enterprise customers)

  • Just-in-Time (JIT) user provisioning

Google SSO Flow

  1. Users select “Sign in with Google”

  2. Google handles authentication securely

  3. Upon successful verification, the user is logged into Bagel

  4. If enabled, users are automatically provisioned on first login (JIT)

No passwords are stored in Bagel when using Google SSO.

For enterprise SAML setup, we provide:

  • ACS URL

  • Entity ID

  • Required attribute mappings (Email required)

  • Metadata exchange instructions

Setup SAML on Microsoft Entra ID (Azure AD)

  1. Step 1: Create the SAML Application in Entra ID

    1. Log into the Microsoft Entra admin center (or Azure portal) and go to Microsoft Entra ID → Enterprise applications

    2. Click New application → Create your own application

    3. Name it Bagel AI, then select “Integrate any other application you don’t find in the gallery (Non-gallery)” and click Create

    4. Once created, open the app and go to Single sign-on → SAML
      (App logo can be set later under Properties if desired.)

  2. Step 2: Configure SAML Settings


    Connection name (same convention as before): bagel-{customerName}-saml
    ​
    In Section 1 – Basic SAML Configuration (click the edit pencil):

    1. Identifier (Entity ID) ← this is Okta’s Audience URI / SP Entity ID: urn:auth0:bagelapp:{connectionName}

    2. Reply URL (Assertion Consumer Service URL) ← this is Okta’s Single sign-on URL: https://login.getbagel.com/login/callback?connection={connectionName}

      Sign on URL — leave empty

      Relay State — leave empty unless needed

      Logout URL — leave empty

    In Section 2 – Attributes & Claims (this is where Okta’s Name ID format / Application username live):

    1. Edit the Unique User Identifier (Name ID) claim

    2. Set Source attribute to user.mail

    3. Set Name identifier format to Email address

  3. Step 3: Send Bagel AI your IdP details

    In Entra these come from Section 3 – SAML Certificates and Section 4 – Set up Bagel AI:

Setup SAML on OKTA

  1. Step 1: Create SAML Application in Okta

    1. Log into Okta Admin Console: Navigate to Applications > Applications

    2. Click “Create App Integration”

    3. Select “SAML 2.0"

    4. Configure General Settings:

      • App name: Bagel AI

      • App logo: ( add logo optionally )

  2. Step 2: Configure SAML Settings

  3. Finally Send these to Bagel AI's team and we'll setup the rest on our side

User Provisioning

Depending on configuration, we can support:

  • Just-in-Time (JIT) user creation

  • SCIM-based provisioning (if enabled)

  • Domain-restricted access (if configured)

Did this answer your question?