Authentication
Single Sign-On (SSO)
SAML

Single Sign-On (SSO)

Let your organization's users sign in to Kensho with your identity provider (IdP) over SAML 2.0. Kensho works with any SAML 2.0 IdP.

Supported features

  • SP-initiated SSO: sign-in starts from Kensho or an application that uses your Kensho subscription.
  • IdP-initiated SSO: sign-in starts from a Kensho tile in your IdP dashboard.
  • Just-In-Time (JIT) provisioning: a matching Kensho account is created on first sign-in.

Prerequisites

To set up SAML 2.0 SSO, Kensho will need to know the following:

  • A list of your corporate email domains (for example, @example.com).
  • Whether all your users should get the same entitlements, or different users need different entitlements (see Entitlements), and if so, the distinct access levels you need (for example, analyst and admin).

Contact the Kensho support team (support@kensho.com) with this information to request SSO. Kensho provisions the connection on its side and sends you:

  • An SSO ID and Audience URI to use below.
  • If different users need different entitlements, the role names to use in the Entitlements step.

Configuration steps

  1. In the Microsoft Entra admin center, go to Entra ID → Enterprise apps.

  2. Click New application, then Browse Entra Gallery.

  3. Search for and select the Kensho app, then click Create.

  4. On the app's overview page, go to Manage → Single sign-on and select SAML.

  5. In the Basic SAML Configuration section, click Edit and enter:

    • Identifier (Entity ID): your Audience URI from Kensho.
    • Reply URL (Assertion Consumer Service URL): https://kensho.okta.com/sso/saml2/<SSO_ID>, replacing <SSO_ID> with your SSO ID from Kensho.

    Save and close the section.

  6. In the SAML Certificates section, copy the App Federation Metadata URL.

  7. Go to Manage → Users and groups and assign the users and groups who need access to Kensho. Only assigned users can sign in. If different users need different entitlements, assign each to the matching app role here (see Entitlements).

Then complete the connection with Kensho:

  1. Send your Metadata URL to the Kensho support team (support@kensho.com).
  2. Kensho activates the connection.

Your SAML configuration for Kensho is complete. Kensho creates each user's account on their first sign-in (JIT provisioning).

SAML attributes

Kensho reads the following attributes from the SAML assertion to create each user. Map each one to the corresponding user profile field in your IdP.

AttributeRequiredExampleDescription
emailYesjane.doe@example.comThe user's email address.
firstNameYesJaneThe user's first name.
lastNameYesDoeThe user's last name.
rolesNousers_app
users_app_admin		The user's entitlements (multi-valued). See Entitlements.

Kensho matches each user to their Kensho account by the email attribute on every sign-in, so it must stay stable.

Entitlements

This is optional. If everyone should get the same entitlements, skip it: assign the relevant groups to the Kensho app in the configuration steps, and all assigned users receive the same entitlements.

For different entitlements, send the multi-valued roles attribute that maps your IdP groups to the role names Kensho provides you.

Use app roles to emit the Kensho role names. In the Microsoft Entra admin center:

  1. Go to Entra ID → App registrations, select the Kensho app, and open App roles.

  2. For each Kensho role name, click Create app role:

    • Display name: any label that describes the entitlement.
    • Allowed member types: Users/Groups.
    • Value: the Kensho-provided role name, exactly as given.
    • Enable the app role and save.

  3. Go to Enterprise apps → the Kensho app → Users and groups and assign each user or group to the matching app role. To give a user or group more than one role, add a separate assignment per role.

  4. Go to Single sign-on → Attributes & Claims and add a claim:

    • Name: roles
    • Namespace: leave empty.
    • Source: Attribute, with source attribute user.assignedroles.

    Save the claim. Entra now sends each assigned user's role names as a multi-valued roles attribute.

SP-initiated SSO

  1. From your browser, navigate to kensho.okta.com (opens in a new tab), a Kensho application, or a partner application that uses your Kensho subscription.
  2. Enter your corporate email address and continue.
  3. You are redirected to your IdP, authenticate there, and are then redirected back to Kensho.

Provisioning

Kensho provisions accounts just-in-time (JIT): the first time one of your users signs in through SSO, Kensho creates their account from the attributes your IdP sends.

Automatic account syncing and deprovisioning (SCIM) is not currently supported.

Troubleshoot

For help configuring or debugging a connection, contact the Kensho support team at support@kensho.com.