Hybrid Authentication (SSO + Application Credentials)

This article describes how to enable hybrid authentication for a company, allowing access through both Single Sign-On (SSO) and application credentials.

This mode is useful for managing scenarios where some users access with SSO, while others use Cyber Guru application credentials.

1. Standard SSO Configuration

To enable hybrid authentication, the first step is to configure the standard SSO. For detailed instructions on configuring standard SSO, refer to the dedicated articles.

Note: When a company switches from traditional authentication to standard SSO, all users are automatically set to access via SSO (authmode = 1).

2. Enabling the Hybrid Authentication Toggle

After completing the standard SSO configuration, you can activate the toggle for hybrid authentication. This option allows you to differentiate the access method for each user, specifying who should authenticate via SSO and who should continue to access with their application credentials.

The toggle is located in the Company Management > General > Authentication section.

If SSO has not been previously configured, the toggle will not be available.

During the initial upload of the user list, you need to add a column named authmode. This column identifies the authentication method for each user:

• 0: access via credentials.

• 1: access via SSO (SAML).

IMPORTANT NOTE: If the company has already activated standard SSO and previously uploaded a user list, it is necessary to update that list by specifying the correct value of the authmode column for each user, even if the company is already live.

4. Mapping the authmode Information During Import

During the import of the user list, you must correctly map the authmode field so that the system understands which authentication mode to assign to each user.

When adding new users through the interface, you can select the authentication method for each user directly from the management menu. The available options are:

• DEFAULT for access via credentials

• SAML for access via SSO

During the go-live phase, you can enable the student caring of "First Content Awareness or Channel" for the company.

If this option is enabled:

• Users with authmode = 0 will receive access credentials via email.

• Users with authmode = 1 will only see the SSO login button.