Single sign-on

CADABRA is an OpenID Connect relying party. You register it as an application in your identity provider, then prove you own the email domains it may sign in.

What is supported

One protocol: OpenID Connect, authorization code flow with PKCE (S256). The id_token must be signed RS256 or PS256.

There is no SAML, no WS-Federation and no LDAP. If your identity team asks, the answer is OIDC only.

The dashboard names Entra ID and Okta because they are what customers bring, but nothing in the implementation is provider specific: any identity provider that publishes an OpenID Connect discovery document and issues a client id and secret is configured the same way.

"Continue with Microsoft" on the sign-in page is a different thing. That is CADABRA’s own Microsoft application, open to anyone, and it does not put the account in an organization. Organization single sign-on is what this page describes.

What CADABRA needs from you

Five fields, on one form under Team, Single sign-on, Set up:

  • Issuer. Must begin with https://. A Microsoft-style tenant template, {tenantid} inside the issuer, is resolved per token from the tid claim, so one configuration covers a tenant that issues its own id.
  • Discovery URL. The .well-known/openid-configuration document, https only. CADABRA reads authorization_endpoint, token_endpoint and jwks_uri from it and refuses the configuration if any of the three is not https. It is cached for one hour.
  • Client ID.
  • Client secret. Required the first time. On a later edit, blank keeps the stored one, which the form says: "Leave the secret blank to keep the one already stored." It is stored AES-256-GCM encrypted and is never returned by the API.
  • Email domains. Comma separated. A public email provider is refused by name: gmail.com, outlook.com, icloud.com and 20-odd others cannot be claimed by an organization.

The scope requested is openid profile email unless one is set through the API.

The redirect URI to register with your provider. The form prints it under the fields.

https://accounts.cadabrai.com/api/auth/sso/callback

Setting it up

  1. 01

    Register the application

    A confidential web application in your identity provider, authorization code flow, with the redirect URI above, releasing openid, profile and email.

  2. 02

    Fill the form

    Team, Single sign-on, Set up. Issuer, Discovery URL, Client ID, Client secret, Email domains. Save answers "Single sign-on saved. Verify your domains to switch it on."

  3. 03

    Add the TXT record

    Each unverified domain appears with its own record and a Verify button, under the line "Add this TXT record at your domain's DNS, then verify. Until a domain is verified it cannot sign anyone in."

  4. 04

    Verify

    Press Verify once DNS has propagated. CADABRA resolves the TXT records itself. A miss answers "That TXT record is not visible yet."; a hit answers "acme.com verified. Your team can sign in with it now."

  5. 05

    Test it

    On the sign-in page, type an address at a verified domain. After a moment the button becomes "Continue with <your display name>". That is home-realm discovery finding your organization by email domain.

The DNS record, at the root of the domain

name   @
type   TXT
value  cadabra-domain-verification=<the token the dashboard prints>

What CADABRA reads out of the id_token

oid, sub          the subject. oid wins when both are present.
email             the address. preferred_username, then upn, are the fallbacks.
email_verified    read, and enforced only when requireVerifiedEmail is set on
                  the configuration. The dashboard form does not set it.
name              display name. given_name is the fallback.
tid               the tenant, used to resolve a {tenantid} issuer template.

iss aud azp nonce exp nbf iat   verified on every sign-in, 120s clock skew.

What happens on a first sign-in

Someone at a verified domain who has never used CADABRA is created and joined to your organization in one step. They take a seat, land on the organization plan, and the activity log records the actor as SSO (org:<id>).

If the organization has no free seat the sign-in itself is refused with "Your organization has used all of its seats." Buy seats before a rollout, not during one.

If the address already has a CADABRA account, that account is linked and joined rather than duplicated. If it already belongs to a different organization, the sign-in is refused.

CADABRA never accepts your provider’s token as its own. The callback verifies the assertion once and mints a first-party session, which the dashboard and the add-in then use. The add-in signs in through the system browser over a loopback listener, so single sign-on covers the SOLIDWORKS panel as well as the dashboard.

Two-step verification still applies. If the account owes a challenge, it is asked for after your provider returns.

What the sign-in errors mean

The sign-in page shows the message on the left. The cause is on the right.

MessageCause
"No single sign-on is set up for that address."No organization has a verified domain matching that email. Check the domain is spelled the same way in the configuration and in the address.
"Your organization has not verified that email domain for single sign-on."Your provider released an address outside the verified list, an alias domain or a .onmicrosoft.com address for example. Add that domain and verify it.
"Your identity provider refused the sign-in. Check with your administrator."The provider returned an error to the callback: assignment, consent, or conditional access.
"Single sign-on is unavailable right now. Try again shortly."An account lookup failed on our side. Nothing to change; the sign-in is refused rather than guessed at.
"That sign-in could not be completed. Try again."Everything else, including an expired sign-in and an id_token that failed verification.

The precise refusals

A caller that asks for JSON gets the reason in full:

  • "Your identity provider did not share an email address, so we cannot match you to an account. Ask your administrator to release the email claim." The email claim is missing and neither preferred_username nor upn filled in.
  • "An account already uses that email, and your identity provider did not prove it owns the address. Sign in with your password, then link single sign-on from your account settings." The address sits outside the domains your configuration claims.
  • "Your browser did not send the sign-in cookie back. Start the sign-in again in this same browser window, and allow cookies for accounts.cadabrai.com." The sign-in state is bound to an HttpOnly cookie so a callback cannot be replayed in another browser. CADABRA retries the round trip once by itself before showing this.
  • "That sign-in took too long. Start it again." A sign-in has 10 minutes between leaving CADABRA and coming back.

Turning it off

Turn off confirms with "Anyone who signs in through your identity provider will have to use a password instead. Your saved configuration is deleted, including the client secret."

Accounts and membership survive it. Anyone provisioned through single sign-on who has no password uses the password reset flow to set one.

What a security review asks next

Is CADABRA SOC 2 certified?
No. CADABRA holds no third-party audit report. These are the controls that are in place today, and we will say exactly this on a security questionnaire. Single sign-on and role-based access on Enterprise. Encrypted in transit, and encrypted at rest under a key held in a hardware-backed vault separate from the data, always on for Enterprise. Indexed CAD content filtered to the account that wrote it. Only the context a given prompt needs is loaded at run time. A 90-day expiry on the operational logs CADABRA keeps about the service. Zero-retention handling on Enterprise, configured per organization. If you are running a vendor review, send us your questionnaire and we will answer it as it stands rather than pointing at a badge.
Is CADABRA secure for company data?
CAD content is encrypted in transit and at rest, under a key held in a hardware-backed vault separate from the data. Indexed content is filtered to the account that wrote it. CADABRA does not sell customer data. Enterprise adds single sign-on and zero-retention handling; on every other plan you can turn training off in dashboard settings.

Next

Single sign-on creates an account the first time someone signs in. It does not remove one when they leave. That is directory sync.

What is stored, and for how long: data handling.