SAML and SCIM Service Provider Endpoints for CloudConnexa
Overview
When you configure an identity provider (IdP) to work with CloudConnexa, you'll need the service provider (SP) values that CloudConnexa uses for authentication and user provisioning.
This page provides the endpoints and configuration values for:
SAML 2.0: Configure single sign-on (SSO) so users can authenticate to CloudConnexa through your IdP.
SCIM 2.0: Configure automated user provisioning from your IdP to CloudConnexa.
You can use these values to configure your IdP manually or build reusable integration templates and catalog connectors.
Find your Cloud ID
Before configuring SAML or SCIM, identify the Cloud ID for the Wide-area Private Cloud (WPC) you're connecting to your IdP.
Your OpenVPN account can contain multiple WPCs, each with its own Cloud ID. Make sure you use the Cloud ID for the WPC you're configuring. For example, if your Cloud ID is example.openvpn.com, the Cloud ID prefix is example.
In the endpoint formats on this page, replace <cloud-id> with that prefix.
SAML values
Use these values when configuring CloudConnexa as a SAML service provider in your IdP.
Value | Also known as | CloudConnexa value |
|---|---|---|
Single Sign-On URL | Assertion Consumer Service (ACS) URL, Reply URL |
|
Issuer Name | SP Entity ID, Audience URI, Identifier |
|
SP certificate | Service provider signing certificate | Available in the SAML Setup Wizard and service provider metadata |
What you need to know:
ACS URL: Use the URL exactly as shown. It's the same for every CloudConnexa WPC.
Issuer Name (SP Entity ID): Replace
<cloud-id>with your WPC's Cloud ID prefix. For example,example.openvpn.com.SP certificate: Get the certificate from the SAML Setup Wizard or the service provider metadata document.
Your IdP may use different labels for these values. For example, Microsoft Entra ID uses Reply URL for the ACS URL and Identifier for the SP Entity ID.
For the complete configuration procedure, refer to SAML Single Sign-On.
Get SP metadata
If your IdP supports metadata import, you can use CloudConnexa's service provider metadata document instead of entering the SP configuration values individually.
To find your metadata:
Sign in to your WPC's Administration portal at your Cloud ID address (for example,
yourcompany.openvpn.com).Navigate to Settings → User Authentication → SAML Single Sign-On.
Select Setup.
The SAML Setup Wizard displays.
Select your IdP.
The SAML Single Sign-On Setup displays with the IdP selected.
Select Download.
The metadata XML file downloads to your machine.
You can then import the metadata into your IdP, if supported.
Supported SAML attributes
When configuring your IdP, you can send the following attributes to CloudConnexa:
Attribute | Information provided |
|---|---|
Email Address | User's email address |
Username | User's username |
Group | Group information for user group mapping |
First Name | User's first name |
Last Name | User's last name |
The exact SAML claim names depend on your IdP. Refer to the setup tutorial for your IdP to determine which claims to configure. If your IdP doesn’t send this attribute, CloudConnexa uses the SAML NameID instead.
If you want to assign users to CloudConnexa user groups based on their IdP group membership, refer to SAML User Group Mapping.
SCIM 2.0 provisioning values
Use System for Cross-domain Identity Management (SCIM) 2.0 to automatically provision users from your IdP to CloudConnexa.
Before you begin: Configure SAML authentication for your WPC before setting up SCIM provisioning.
To find your SCIM configuration, navigate to Settings → User Authentication → SAML Single Sign-On → Configuration → SCIM 2.0.
Value | CloudConnexa value |
|---|---|
SCIM endpoint URL |
|
Authentication method | Header token authentication |
Provisioning Token format |
|
Token lifetime | Six months to no expiry |
Replace <cloud-id> with your WPC's Cloud ID prefix. For example, if your Cloud ID is example.openvpn.com, your SCIM endpoint URL is https://example.api.openvpn.com/api/v1/scim.
Use the Provisioning Token generated in CloudConnexa to authenticate provisioning requests from your IdP.
What SCIM can provision
SCIM provisions users, not user groups
You can use SCIM to manage users in CloudConnexa, but you'll need SAML group claims and user group mapping rules to manage their group membership.
To configure group membership, refer to SAML User Group Mapping.
Choose a Provisioning Token lifetime
When you generate a Provisioning Token, you can choose an expiration period ranging from six months to no expiry.
We recommend selecting an expiration period and rotating the token regularly.
If you're building an integration for the Microsoft Entra application gallery, check its provisioning authentication requirements before choosing a token lifetime. Gallery integrations may restrict long-lived bearer tokens.