---
title: SAML and SCIM Service Provider Endpoints for CloudConnexa
canonical: https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/saml-and-scim-service-provider-endpoints-for-cloudconnexa/
product: CloudConnexa Docs
description: Find the SAML 2.0 and SCIM 2.0 service provider values for CloudConnexa — ACS URL, Issuer Name (SP Entity ID), SP certificate, SCIM endpoint URL, and provisioning token format. Use these to configure your identity provider or build an integration template.
---

# SAML and SCIM Service Provider Endpoints for CloudConnexa

## Overview

When you configure an identity provider (IdP) to work with CloudConnexa, you'll need the service provider (SP) values that CloudConnexa uses for authentication and user provisioning.

This page provides the endpoints and configuration values for:

- **SAML 2.0:** Configure single sign-on (SSO) so users can authenticate to CloudConnexa through your IdP.
- **SCIM 2.0:** Configure automated user provisioning from your IdP to CloudConnexa.

You can use these values to configure your IdP manually or build reusable integration templates and catalog connectors.

## Find your Cloud ID

Before configuring SAML or SCIM, identify the Cloud ID for the Wide-area Private Cloud (WPC) you're connecting to your IdP.

Your OpenVPN account can contain multiple WPCs, each with its own Cloud ID. **Make sure you use the Cloud ID for the WPC you're configuring.** For example, if your Cloud ID is `example.openvpn.com`, the Cloud ID prefix is `example`.

In the endpoint formats on this page, replace `<cloud-id>` with that prefix.

## SAML values

Use these values when configuring CloudConnexa as a SAML service provider in your IdP.

| **Value** | **Also known as** | **CloudConnexa value** |
| --- | --- | --- |
| Single Sign-On URL | Assertion Consumer Service (ACS) URL, Reply URL | `https://sso-backend.openvpn.com/sso/api/v1/saml/acs` |
| Issuer Name | SP Entity ID, Audience URI, Identifier | `<cloud-id>.openvpn.com` |
| SP certificate | Service provider signing certificate | Available in the SAML Setup Wizard and service provider metadata |

### What you need to know:

- **ACS URL:** Use the URL exactly as shown. It's the same for every CloudConnexa WPC.
- **Issuer Name (SP Entity ID):** Replace `<cloud-id>` with your WPC's Cloud ID prefix. For example, `example.openvpn.com`.
- **SP certificate:** Get the certificate from the SAML Setup Wizard or the service provider metadata document.

Your IdP may use different labels for these values. For example, Microsoft Entra ID uses **Reply URL** for the ACS URL and **Identifier** for the SP Entity ID.

For the complete configuration procedure, refer to [SAML Single Sign-On](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-authentication-for-users.md).

## Get SP metadata

If your IdP supports metadata import, you can use CloudConnexa's service provider metadata document instead of entering the SP configuration values individually.

To find your metadata:

1. Sign in to your WPC's Administration portal at your **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Settings → User Authentication → SAML Single Sign-On**.
3. Select **Setup**.
   - The SAML Setup Wizard displays.
4. Select your IdP.
   - The SAML Single Sign-On Setup displays with the IdP selected.
5. Select **Download**.
   - The metadata XML file downloads to your machine.
6. You can then import the metadata into your IdP, if supported.

   > **Note**
   >
   > CloudConnexa also needs your IdP's signing certificate to validate SAML assertions. You can provide it using an IdP metadata URL, metadata document, or manual configuration. Refer to [SAML Single Sign-On](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-authentication-for-users.md) for instructions.

## Supported SAML attributes

When configuring your IdP, you can send the following attributes to CloudConnexa:

| **Attribute** | **Information provided** |
| --- | --- |
| Email Address | User's email address |
| Username | User's username |
| Group | Group information for user group mapping |
| First Name | User's first name |
| Last Name | User's last name |

The exact SAML claim names depend on your IdP. Refer to the setup tutorial for your IdP to determine which claims to configure. If your IdP doesn’t send this attribute, CloudConnexa uses the SAML NameID instead.

If you want to assign users to CloudConnexa user groups based on their IdP group membership, refer to [SAML User Group Mapping](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules.md).

## SCIM 2.0 provisioning values

Use System for Cross-domain Identity Management (SCIM) 2.0 to automatically provision users from your IdP to CloudConnexa.

**Before you begin:** Configure SAML authentication for your WPC before setting up SCIM provisioning.

To find your SCIM configuration, navigate to **Settings → User Authentication → SAML Single Sign-On → Configuration → SCIM 2.0**.

| **Value** | **CloudConnexa value** |
| --- | --- |
| SCIM endpoint URL | `https://<cloud-id>.api.openvpn.com/api/v1/scim` |
| Authentication method | Header token authentication |
| Provisioning Token format | `<cloud-id>:<token>` |
| Token lifetime | Six months to no expiry |

Replace `<cloud-id>` with your WPC's Cloud ID prefix. For example, if your Cloud ID is `example.openvpn.com`, your SCIM endpoint URL is `https://example.api.openvpn.com/api/v1/scim`.

Use the Provisioning Token generated in CloudConnexa to authenticate provisioning requests from your IdP.

## What SCIM can provision

### SCIM provisions users, not user groups

You can use SCIM to manage users in CloudConnexa, but you'll need SAML group claims and user group mapping rules to manage their group membership.

To configure group membership, refer to [SAML User Group Mapping](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules.md).

### Choose a Provisioning Token lifetime

When you generate a Provisioning Token, you can choose an expiration period ranging from six months to no expiry.

We recommend selecting an expiration period and rotating the token regularly.

If you're building an integration for the Microsoft Entra application gallery, check its provisioning authentication requirements before choosing a token lifetime. Gallery integrations may restrict long-lived bearer tokens.

## Related resources

### Configure SAML authentication

- [SAML Single Sign-On](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-authentication-for-users.md)
- [SAML User Group Mapping](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules.md)
- [User Authentication](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/about-user-authentication.md)

### Identity provider tutorials

- [Authenticate Using SAML with Microsoft Entra ID](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-microsoft-entra-id.md)
- [Authenticate Using SAML with Okta](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-okta.md)
- [Authenticate Using SAML with Google Workspace](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-google-workspace.md)
- [Authenticate Using SAML with Keycloak](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-keycloak.md)
- [Authenticate Using SAML with OneLogin](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-onelogin.md)
- [Authenticate Using SAML with JumpCloud](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-jumpcloud.md)

---

Prev: [SAML Single Sign-On](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-authentication-for-users.md)
Next: [SAML User Group Mapping](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules.md)
Index: https://openvpn.net/cloud-docs/llms.txt