Single Sign-On (SSO)

Single Sign-On (SSO) lets members of your organization authenticate with your corporate identity provider (Okta, Azure AD, Google Workspace, and others) instead of managing a separate password.

​

Before you start

• Confirm you have an Admin role on Apostra account where you want to enable SSO.
• Have a member of the team with access to your identity provider’s admin console available — completing setup requires either its SAML metadata URL or XML.
• Use a corporate email address as your Apostra sign-in. Public domains (gmail.com, yahoo.com, etc.) are not supported.

​

Setting up SSO

​

Step 1 — Sign in to app.apostra.com

Sign in at app.apostra.com with your Admin account.

​

Step 2 — Open Account configuration on the homepage

From the homepage, find the Admin section and select Account configuration.

​

Step 3 — Register your company domain

Ensure your company domain has been registered and verified. In the Registered company domain section, enter your company domain and click Save:

• If the domain matches your sign-in email (e.g., signed in as you@acme.com registering acme.com), it’s auto-verified immediately.
• If it doesn’t match (or for an account under an organization whose domain differs), the row goes to Pending Apostra approval.

​

Step 4 — Confirm the domain is Verified

Once the domain shows the Verified chip, the SSO section unlocks and the Open setup portal button becomes clickable.

​

Step 5 — Review the Single Sign-On (SSO) section

In the Single Sign-On (SSO) section below the domain section you’ll see setup instructions and an Open setup portal button.

​

Step 6 — Follow the steps in the setup portal

Click Open setup portal. A guided portal opens in a new tab and walks you through three sub-steps.

​

6a — Select your identity provider

Pick your identity provider from the list (Okta, Azure AD, Google Workspace, and others).

​

6b — Follow the configuration steps

Work through every step the portal presents — uploading SAML metadata, mapping attributes, and any provider-specific configuration.

​

6c — Test Single Sign-On

Once you’ve completed every step, the final step lets you Test Single Sign-On. If the test doesn’t pass, please reach out to Apostra for support.

​

Step 7 — Your team can now sign in with SSO

Once the test passes, members of your organization can sign in to app.apostra.com with their corporate credentials.

​

Updating SSO configuration

After SSO is active, you can update or replace your identity provider connection at any time by returning to Account configuration → Single Sign-On (SSO) and clicking Open setup portal again.

​

Troubleshooting a timeout

If Google Workspace, Okta, or another provider appears to time out, retry once in a fresh browser session. If the failure happened in the setup portal, return to Account configuration and open a new portal link. If it happened during sign-in, start again from Apostra sign-in page. A timeout alone does not identify the cause, so do not assume the five-minute setup-link expiry was responsible unless the portal explicitly says the link expired. If the retry fails, send Apostra support this evidence:

• the approximate time of the failure, including time zone;
• your company domain and identity provider;
• browser name and version;
• the failed stage: domain check, redirect to the provider, provider sign-in, return to Apostra, or session creation;
• a screenshot of the error; and
• the diagnostic ID shown with the error, if one appears.

Never send browser cookies, OAuth authorization codes, access or refresh tokens, passwords, or SAML assertions. Apostra can correlate the diagnostic ID and timestamp with privacy-safe server telemetry without those secrets.

​

Next steps