How to set up Single Sign-On (SSO)

Single Sign-On (SSO) lets your users sign in to Kudos using their existing company credentials. This simplifies login, enhances security, and ensures compliance with your IT policies. Kudos supports SAML 2.0 and works with a wide range of identity providers, including Microsoft Entra (formerly Azure), Okta, OneLogin, and others.

Setting up SSO typically involves someone from your IT team or an identity provider (IdP) administrator. Kudos provides a simple, metadata-based configuration flow suitable for most providers.

• Replacing email/password login with secure company-wide authentication
• Enforcing company security standards through your identity provider
• Preparing for enterprise compliance audits
• Managing access centrally via your IdP

Exchanging metadata

This step connects Kudos and your IdP by sharing configuration files. Each side needs the other’s metadata to establish a secure link. Depending on your SSO provider, refer to the correct documentation for detailed step-by-step instructions:

• SSO Setup Guidance for Microsoft Entra (formerly Azure)
• SSO Setup Guidance (All providers)

Configuring claims

Claims tell Kudos which user attributes to trust from your identity provider. At minimum, you must configure Name ID (nameidentifier) and Email, and optionally FirstName and LastName. In all cases, the claim names must be identical to the ones provided in the documentation - your connection will fail if claim names are spelled incorrectly.

Note: A missing nameidentifier claim will cause your SSO to fail so it must be part of your setup.

Testing your SSO connection

Before adding everyone to your SSO integration, it's advisable to test the setup and confirm users can sign in. Ensure your connection is enabled in Kudos and you are logged out of Kudos before testing.

1. Check that SAML version, signing options, and algorithms match Kudos requirements
2. Test the connection using the Test button in your IdP

OR

1. Set up restricted access to the Kudos SSO integration in your IdP
2. Test via the Kudos login page - users granted access in your IdP will see the SSO option

Managing your auto-provisioning settings

Use the Automatically create users on SSO sign-in setting when your organization wants to streamline user access through an SSO connection without needing to create accounts in advance. 

• Disabled: users must be added to Kudos before they can successfully sign in with SSO
• Enabled: a new user account is automatically created when they first sign in using SSO - as long as they are authenticated by your identity provider
  Note: This is helpful for onboarding new employees quickly, since they can access Kudos right away without waiting for an admin to add them

Requiring SSO for all users

Once your testing is complete and successful, you can enforce SSO for all users. Remember to clearly communicate this change ahead of time; it will disable email and password access for all users. 

1. In your IdP, assign the correct users or groups to the Kudos SSO application
2. In Kudos, go to Kudos > Admin > Integrations > Single Sign-On
3. Toggle on the Require SSO for all users option

• Always test with a small user group before enforcing SSO org-wide.
• Make sure the Name ID attribute is consistent and does not change over time.
• Contact your IT team if unsure about claims or attributes.
• Download metadata files directly - do not reuse samples or screenshots.

Q: What happens if I enable "Require SSO for all users"?
A: All users must log in through your identity provider. Email/password login will be disabled.

Q: Can I deactivate or delete an SSO connection?
A: Yes. You can temporarily deactivate SSO or delete the configuration entirely from the Single Sign-On page.

Q: Can I use email as the Name ID claim?
A: It is strongly discouraged. If a user’s email changes, a duplicate account may be created. Use a stable attribute like Object ID or Employee ID.

Q: Can users access Kudos without an invite if they are included in my IdP's SSO group?
A: Yes. SSO is your internal gateway to the Kudos platform, which means anyone with access to your Kudos SSO integration will have direct access to Kudos.

Q: Can I make SSO a requirement only for a specific segment of users?
A: No. At this time, requiring SSO must apply to all users so it's best to leave it disabled if some of your users need to login using email and password.

Problem: Login fails after setup

• Confirm metadata files were uploaded correctly on both sides.
• Make sure you've setup claims for Name ID and Email
• Check that you have correctly spelled each claim name (see table above)
• Ensure assigned users have access to the Kudos app in your IdP.

Problem: Testing worked but users are locked out

• Check if "Require SSO for all users" is enabled.
• Make sure group assignments are configured properly in your IdP.

Problem: Metadata file upload fails

• Try re-downloading from your IdP or using a different browser.
• Verify the file format is correct and unmodified (.xml).