Positive SSO (SAML)

The Positive SSO service integrates Cortex authentication with external SAML-based Identity Providers (IdPs). In this integration, Cortex acts as the Service Provider (SP).

This enables federated authentication where users authenticate via their organisation's identity provider and are seamlessly logged into Cortex-powered applications.

Environments

Postman Collection

For full request/response examples including SAML payloads, use the Postman collection:

Positive SSO Collection

Authentication Flow

1. SP-Initiated Login — The user accesses a Cortex application, which redirects to the IdP for authentication
2. IdP Authentication — The user authenticates with the IdP (e.g. Active Directory, Okta)
3. SAML Response — The IdP sends a signed SAMLResponse back to Cortex
4. Token Exchange — Cortex validates the SAML assertion and issues a JWT access token
5. Logout — Can be initiated from either the SP or the IdP

Key Concepts

• Service Provider (SP): Cortex — the application that relies on the IdP for authentication
• Identity Provider (IdP): The external auth system (e.g. Active Directory, Okta, Azure AD)
• SAMLResponse: Signed XML assertion containing authentication/logout confirmation
• SAMLRequest: Signed XML request for initiating logout
• RelayState: The URL to redirect to after the SAML operation completes
• JWT: After SAML validation, Cortex issues its own JWT for subsequent API calls