Single Sign-On (SAML)

Paid plans can connect their own identity provider (Microsoft Entra ID, Okta, or any SAML 2.0 IdP), so your team signs in to Aether365 through your organization's SSO - with your own MFA and access policies applied.

How it works

1. You register Aether365 as a SAML application in your identity provider.
2. You paste the IdP metadata URL and your email domain into Aether365 and verify the domain with a DNS TXT record.
3. From then on, anyone entering an email on that domain at the sign-in page is sent to your identity provider. On first sign-in they automatically join your account as a Member (read-only - see Managing Team Members).

Setting up SSO

Open Settings and choose the SSO tab (paid plans only).

1. Create the SAML application in your IdP

Use the Service Provider details shown on the SSO page:

Field	Value
ACS URL	Shown on the page (.../saml2/idpresponse)
SP Entity ID	Shown on the page (urn:amazon:cognito:sp:...)
NameID format	Persistent

Your IdP must send the user's email address as the emailaddress claim (http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress). Microsoft Entra ID and Okta do this by default in their standard SAML templates.

2. Register the metadata and domain

• Metadata URL: your IdP's federation metadata document (for Entra ID: https://login.microsoftonline.com/<tenant>/federationmetadata/2007-06/federationmetadata.xml?appid=<app-id>).
• Domain: the email domain your team signs in with (e.g. acme.com). Public email providers cannot be used.

Click Save. The configuration stays Pending until the domain is verified.

3. Verify the domain

Add the TXT record shown on the page to your domain's DNS:

Record type	Name	Value
TXT	acme.com	aether365-site-verification=<token>

DNS changes can take a few minutes to propagate. Then click Verify & activate. On success the status switches to Active and SSO is live.

Signing in with SSO

Team members go to the normal sign-in page and enter their work email. When the email domain has active SSO, they see Continue with SSO and are redirected to your identity provider. After authenticating there, they land back in Aether365.

First-time users are provisioned automatically as Members of your account (your plan's member limit applies). The Owner can raise a member's role afterwards from the Team page.

Changing or removing SSO

• Changing the metadata URL on an active configuration updates the identity provider in place.
• Changing the domain requires verifying the new domain again.
• Remove deletes the SSO configuration; team members keep their accounts but sign in with their previous method again.

Keep an owner sign-in available

The account Owner should keep a non-SSO sign-in method (Microsoft account or password). If your IdP has an outage or the SAML application is misconfigured, the Owner can still sign in and fix the configuration.

Troubleshooting

Problem	Fix
"We could not find that TXT record yet"	Wait for DNS propagation (up to 15 minutes) and check the record name and exact value.
"We could not activate your identity provider"	The metadata URL must be reachable and contain a valid SAML 2.0 IdP descriptor.
Sign-in loops or IdP error page	Check the ACS URL and SP Entity ID in your IdP match the values on the SSO page exactly.
User signed in but has no data	They joined as a new Member of your account - check the Team page; the member limit may have been reached.

Related

• Managing Team Members - roles and what Members can access
• Security Model