Single Sign On (SSO)
Updated at August 20th, 2026
Table of Contents
Paradox offers you the ability to access our application with an additional layer of user authorization via their existing user management system and Identity Provider (IdP). This is known as Single Sign On (SSO).
Configuration
Paradox strongly recommends the complete configuration and testing of SSO in the staging environment prior to a production implementation.
Setting up SSO requires Paradox support and typically only asynchronous communication methods (e.g. email). The setup process may be conducted as follows:
- Expressing interest in the use of SSO to your CS Representative.
- Your CS Representative will then configure Paradox as a Service Provider (SP) in your IdP.
You may then test your new SSO application and confirm the configuration is valid. This same process will need to be repeated in the production environment as well.
Single Sign On Logic: Basic/Limited Users are not forced to use Single Sign On (SSO) and can log in via MFA if they have login access. There is no validation logic that forces SSO for Basic/Limited Users.
Specification
| Requirement | Description |
|---|---|
| Name ID format |
We support the following SAML 2.0 values:
|
| Username format |
We support the use of either:
|
| SAML 2.0 Attributes |
We require the following attributes:
|
FAQs
| What is Paradox's SP Metadata? | Provided during the implementation process. |
| What is Paradox's Application Entity ID? | Provided during the implementation process. |
| What is Paradox's Assertion Consumer Service (ACS) URL? | Provided during the implementation process. |
| What is Paradox's Single Logout (SLO) URL? | Provided during the implementation process. |
| What Signature Algorithm does Paradox use? | SHA-256 |
| What Digest Algorithm does Paradox use? | SHA-256 |
| Does Paradox support both IdP and SP initiated SSO? | Yes |
| Are response assertion signatures required? | Yes |
| Is assertion encryption required? | No |
| Does Paradox support assertion encryption? | Yes |
| Is SSO Multi-Factor Authentication (MFA) required? | No |
| Does Paradox support SSO MFA? | Yes |
| Is the ForceAuthn parameter required? | No |
| Is the RelayState parameter required? | No |
| I logged out of the system. Why does it still show me as logged in? | When a user logs out of the CEM, the session is only ended locally, meaning that the session specific to the Paradox app is terminated and all related local data is cleared. Paradox does not intentionally trigger a Single Logout (SLO) request to the Identity Provider (IdP), as doing so would log the user out of all other applications that rely on the same IdP. This could disrupt their ongoing work in those apps, so the logout experience is limited to just the Paradox service. |