Skip to main content
SSO Providers let your organisation’s people sign in to Pria with the account they already have — through an external identity provider such as QuickLaunch, Okta or Azure AD, using the OAuth 2.0 Authorization Code flow. Once configured, users visit a dedicated URL (/sso/{slug}) and are logged into Pria automatically. Pria’s SSO uses OAuth 2.0 / OpenID Connect; SAML 2.0 is an enterprise arrangement — contact humans@praxis-ai.com.
SSO Providers require the SSO admin entitlements (sso.list, sso.add, sso.edit, sso.delete). See Entitlements for details.

​
How SSO Works

When a user visits the SSO login URL, Pria redirects them to the identity provider for authentication. After the user authenticates, the identity provider sends an authorization code back to Pria, which exchanges it for user information server-side.
The authorization code is one-time use and can only be exchanged for a token using the client secret, which only the backend has. The client secret never reaches the browser.

​
Managing SSO Providers

Navigate to Admin > SSO Providers (/admin/sso) to manage your institution’s SSO configuration.

​
Creating a Provider

1

Open SSO Providers

Navigate to Admin > SSO Providers and click Add SSO Provider.
2

Select Institution

Choose the Digital Twin this SSO provider belongs to (the picker calls it an institution — same thing). Each Digital Twin can have one SSO provider.
3

Choose a short name for the web address (the Slug)

Use lowercase letters, numbers and hyphens only — for example my-university. Your people will sign in at https://your-domain.com/sso/my-university.
4

Configure OAuth Endpoints

Enter the identity provider’s OAuth 2.0 endpoints:
5

Configure Field Mapping

Map identity provider user fields to Pria user fields. These defaults match most OpenID Connect providers:
If your identity provider uses different field names (e.g., mail instead of email), update the mapping accordingly. Incorrect mapping will prevent user accounts from being created.
6

Enable and Save

Toggle Enabled to activate the provider, then save. The SSO login URL is immediately active.

​
Testing Connectivity

After saving, use the Test button to verify the backend can reach the identity provider’s token endpoint. This confirms the Token Host URL is correct and accessible.

​
Callback URL Registration

You must register the callback URL with your identity provider. The callback URL follows this pattern:
For example, if your domain is pria.praxislxp.com and the slug is my-university:
The callback URL must match exactly what is registered with the identity provider. A mismatch will cause an invalid_callback error.

​
User Experience

​
SSO Login Flow

When a user visits /sso/{slug}:
  1. If the provider is enabled, the user is redirected to the identity provider’s login page
  2. After authenticating, the user is automatically logged into Pria and enrolled in the associated Digital Twin
  3. If the user already has an active session, they see options to Logout or Continue

​
Error Handling

​
Required Entitlements

SSO Provider management requires the following admin entitlements:
These entitlements are managed on the Entitlements page. An admin must have the appropriate SSO entitlements assigned on their Digital Twin membership.

​
Security

  • Client secrets are stored in the database and masked in API responses and the admin UI
  • The authorization code exchange happens server-to-server; the client secret never reaches the browser
  • SSO users are automatically enrolled in the Digital Twin associated with the provider
  • Provider configuration changes take effect immediately (the OAuth client cache is invalidated on save)