Enterprise Single Sign-On (SSO)

C Tech accounts support enterprise single sign-on (SSO) through SAML 2.0. Once connected, everyone in your organization signs in to account.ctech.com with their existing corporate credentials. There are no separate C Tech passwords to create, distribute, or reset. Your IT department keeps full control of who has access.

Setup is a one-time exchange between your IT department and C Tech, typically 30 to 60 minutes end to end. There is no software to install.

How it works

1. Your IT department creates a SAML application in your identity provider (Microsoft Entra ID, Okta, Google Workspace, or any SAML 2.0 provider) using the two values below.
2. Your IT department assigns the employees or groups who should have access.
3. You send us your SAML metadata (a URL, or the metadata XML file for Google Workspace) and the email domain(s) your team signs in with.
4. We register your identity provider and verify your domains.
5. A pilot user from your team signs in to confirm; done.

After setup, anyone entering a company email address at the C Tech sign-in page is sent to your identity provider automatically. Accounts are created on first sign-in; there is nothing to pre-provision on our side.

Values for your SAML application

Your IT department needs exactly two values to create the SAML application:

The SAML assertion must include the email attribute, named exactly. Send the user’s name as name, or as given_name and family_name if your provider only has separate first and last names:

Users can edit their name in their C Tech profile afterwards.

Microsoft Entra ID (Azure AD)

1. In the Entra admin center, go to Applications > Enterprise applications > New application > Create your own application, choose Integrate any other application you don’t find in the gallery, and name it (for example, “C Tech Account”).
2. On the application’s Single sign-on page, choose SAML.
3. In Basic SAML Configuration, set:
   • Identifier (Entity ID): urn:amazon:cognito:sp:us-east-2_L5KrqztvR
   • Reply URL (ACS URL): https://auth.ctech.com/saml2/idpresponse
4. In Attributes & Claims, add two claims with these exact names:
   • email (source: user.mail)
   • name (source: user.displayname)
5. In Users and groups, assign the employees or groups who should have access.
6. From the SAML Certificates section, copy the App Federation Metadata Url.

Okta

1. In the Okta admin console, go to Applications > Applications > Create App Integration, choose SAML 2.0, and name it (for example, “C Tech Account”).
2. On the Configure SAML step, set:
   • Single sign-on URL: https://auth.ctech.com/saml2/idpresponse
   • Audience URI (SP Entity ID): urn:amazon:cognito:sp:us-east-2_L5KrqztvR
   • Leave Name ID format as EmailAddress and Application username as Okta username.
3. In Attribute statements, add three rows (Name format: Unspecified):
   • email = user.email
   • given_name = user.firstName
   • family_name = user.lastName
4. On the Assignments tab, assign the employees or groups who should have access.
5. On the Sign On tab, under SAML Signing Certificates, use the SHA-2 certificate’s Actions > View IdP metadata and copy that URL.

Google Workspace

Google Workspace can act as the SAML identity provider through a custom SAML app. Google provides the metadata as a downloadable XML file rather than a URL, so you will send us that file.

1. In the Google Admin console, go to Apps > Web and mobile apps, then Add app > Add custom SAML app, and name it (for example, “C Tech Account”).
2. On the Google Identity Provider details step, choose Download metadata and keep the downloaded GoogleIDPMetadata.xml file; this is what you send us.
3. On the Service provider details step, set:
   • ACS URL: https://auth.ctech.com/saml2/idpresponse
   • Entity ID: urn:amazon:cognito:sp:us-east-2_L5KrqztvR
   • Name ID format: EMAIL
   • Name ID: Basic Information > Primary email
4. On the Attribute mapping step, add three mappings:
   • Basic Information > Primary email to app attribute email
   • Basic Information > First name to app attribute given_name
   • Basic Information > Last name to app attribute family_name
5. Finish, then open the app and under User access turn it ON for everyone, or for the organizational units or groups who should have access.

What to send us

Email accounts@ctech.com with:

1. Your SAML metadata: the metadata URL for Entra ID or Okta (certificate renewals then apply automatically), or the downloaded metadata XML file for Google Workspace.
2. Every email domain your team signs in with (for example, example.com and example.co.uk). Sign-in routing and account creation are limited to the domains we verify for your organization, so the list must be complete.
3. A pilot user willing to test sign-in once we confirm setup.

We will confirm when your identity provider is registered, usually within one business day. Your pilot user then signs in at account.ctech.com with their company email to complete the verification.

Frequently asked questions

Who controls access? Your IT department. Only users assigned to the SAML application in your identity provider can sign in; removing a user there removes their access to C Tech accounts.

Do SSO users have C Tech passwords? No. Their credentials live entirely with your identity provider, including any multi-factor authentication policies you enforce there.

What about employees who already have C Tech accounts? Existing password-based accounts with a verified company email are linked automatically on their first SSO sign-in; entitlements and history carry over.

Does this cover multiple email domains? Yes. We verify each domain you send us; large organizations commonly register several.

Is OpenID Connect (OIDC) supported? SAML 2.0 is the supported protocol for enterprise SSO, and every major identity provider (Entra ID, Okta, Google Workspace, Ping, OneLogin) supports it. Contact us if your provider is OIDC-only.

We use Google Workspace. Can our team just use “Sign in with Google”? Not as a consumer-style button; C Tech accounts do not offer social sign-in. Set up the Google Workspace SAML app above instead: the result is the same for your team (they enter their work email and land on Google’s sign-in), and your admins keep control of access.