Configure end user authentication

End user authentication controls how end users sign in when connecting to MCP servers from AI clients such as Claude or Cursor. It is configured separately from the account's SSO, which applies to workspace users signing in to integrator.io.

This article describes end user IdPs, which are federated through Celigo Identity: the end user is redirected from Celigo to the identity provider and back, and Celigo issues the resulting token and enforces group and capability access. This is distinct from the MCP server's own Identity provider setting, available on the server's Access tab as Celigo or External. When set to External, the MCP client authenticates directly with the identity provider, Celigo does not issue a token, and none of the functionality described in this article, end users, groups, capability access, and per-user request logs, applies to that server. Selecting External on the basis of an existing IdP integration (for example, Okta) does not carry over any of these capabilities to that server.

Choose an authentication method

End users have two authentication options:

This choice determines how end users sign in; it is unrelated to the MCP server's own Identity provider setting described in the callout above, and configuring one does not affect the other. Once an external IdP is configured, it can support two optional features: group sync and JIT provisioning (see Field reference below). These are not separate sign-in methods, they are additions to the external-IdP path.

Multiple IdPs can be configured per account, each handling specific email domains. Celigo credentials remain the fallback for any end user whose domain does not match a configured IdP, unless an IdP is set to handle "All end users," in which case Celigo credentials are disabled for end users on that account.

End-user IdP configuration is defined per account. The end-user object itself is shared across accounts, but access is granted independently per account, an end-user record in account A does not automatically receive access in account B. Access in a second account requires a separate invitation or JIT sign-in..

Prerequisites

• You need the administrator access level on your account.
• Your account must be on multi-environment. End-user authentication settings aren't available on legacy sandbox-only accounts.
• End users must be invited (or auto-provisioned through JIT) before authentication settings apply to them. See Invite and manage end users.

Celigo credentials for end users

Celigo credentials are the default. When you invite an end user, they get an email to set their password, then sign in with their email and password during the MCP OAuth flow. 

End-user Celigo credentials are separate from workspace-user credentials, even when the same person holds both, signing in as one doesn't sign them in as the other. But it's still one email, one password, and one MFA enrollment; what differs between the two is what each sign-in grants access to. No extra configuration needed here; Celigo credentials are available out of the box.

Configure MFA for end users on Celigo credentials

You can enforce MFA for end users on Celigo credentials. This is independent of the account-level MFA settings that apply to workspace users, in fact, the platform-wide MFA mandate doesn't reach end users at all. Require MFA below is the only thing that enforces MFA for them, and it's off by default.

1. Go to Account (the avatar at the top right of the page), and then select Security.
2. On the left, go to End users → Authentication.

3. Scroll down to End users with Celigo credentials. [image]

   

4. Configure the settings:
   • Require MFA: Off by default. Turn it on to require MFA for all end users on Celigo credentials. Anyone who hasn't enrolled gets prompted to set it up on their next sign-in, and receives an email letting them know MFA is now required.
   • Allow trusted devices: Selected by default. Lets end users mark a device as trusted and skip the MFA prompt on it for a configurable number of days. Clear this checkbox to require an MFA code on every sign-in instead.
   • Number of days until MFA is required: How many days a trusted device can skip the MFA prompt before needing a new code. Only applies when trusted devices are allowed. Defaults to 90 days if left blank.
5. Click Save. End users on external IdPs aren't affected by these settings, MFA for them is handled entirely by the IdP.

How MFA enrollment works for end users

Once you turn on Require MFA, unenrolled end users are prompted to set up MFA with an authenticator app on their next sign-in through an MCP client. Enrollment happens right there in the MCP OAuth sign-in flow, no separate page or portal to visit.

Domain routing rules

When you configure multiple IdPs, Celigo routes each end user by email domain:

1. If an "All end users" IdP is enabled, everyone goes there, no other IdPs are allowed, and Celigo credentials are turned off.
2. Otherwise, Celigo looks for an IdP whose specific email domains list contains the end user's domain, and routes them there if it finds one.
3. If no IdP matches, the end user signs in with Celigo credentials. Domain matching is exact and case-insensitive. acme.com doesn't match dev.acme.com, list each subdomain explicitly if you want it routed too.

Example: an existing Celigo-credentials user gets caught by a new IdP

Say an end user has been signing in with Celigo credentials, and you add a new IdP that claims their email domain (or set an "All end users" IdP). Their next sign-in redirects to the IdP instead. JIT provisioning links the IdP to their existing end-user record (matched by email), so they keep their group memberships, sign-in history, and access, but their Celigo password stops working for end-user authentication on this account. This linking only goes one way. Once someone's authenticated through an IdP, removing that IdP doesn't restore their Celigo password, they'd need to be re-invited to set a new one.

Add an external identity provider

External IdPs let end users authenticate through your organization's identity provider — Okta, Microsoft Entra ID, and others, instead of Celigo credentials. If you also turn on group sync, the IdP becomes the source of truth for group memberships; Celigo still issues the token and enforces access based on those memberships. Before you start, make sure you have:

• An OIDC application created in your IdP for Celigo MCP. See the per-provider walkthroughs:
  • Configure Okta as an end-user IdP
  • Configure Microsoft Entra ID as an end-user IdP
  • Configure Google Workspace as an end-user IdP
  • Configure any OIDC identity provider as an end-user IdP (includes the Auth0 special case: Auth0 reserves the claim name groups, so a groups claim needs to go under a namespaced URI claim instead)
• The Issuer URL, Client ID, and Client Secret from your IdP. 

To add an IdP in Celigo:

1. Go to Account (the avatar at the top right of the page), and then select Security.
2. On the left, go to End users → Authentication.

3. In the External identity providers section, click Add IdP.

   

   Note: To add a new identity provider, you must first disable all existing IdPs. The Add IdP option is available only when all existing IdPs are disabled.

4. Enter or select the required details in the IdP configuration page. See Field reference below.

5. Click Save.

After saving, end users whose email domain matches the IdP's routing rule get sent to that IdP on their next sign-in. To turn on group sync and JIT provisioning for this IdP, see Configure group sync for external IdPs.

External IdP - Field reference

General: 

• Name: A descriptive name for this IdP configuration (for example, "Acme Okta" or "Acme Entra").
• Routing mode: Which end users get sent to this IdP:
  • All end users: Every end user on this account routes here. Only one "All end users" IdP can exist per account; when set, no other IdPs can be added, and Celigo credentials are turned off for end users on this account.
  • Specific email domains: End users whose email domain matches one of the listed domains route here. You can list multiple domains per IdP (for example, acme.com and acme.co.uk), but each domain can only belong to one IdP account wide.
• Enter the Email domains, users with these email domains will sign in through this identity provider.

OIDC configuration:

• Issuer URL: The OIDC issuer URL for your IdP (for example, https://acme.okta.com). Celigo discovers the rest of the OIDC endpoints from /.well-known/openid-configuration.
• Client ID: The client ID from your IdP application.
• Client Secret: The confidential secret issued by your identity provider for this application. Used to authenticate token requests. Stored encrypted.
• Callback URL: Read-only. Copy this URL, then paste it into the Callback URL field of your identity provider (IdP) configuration.

Group sync and provisioning:

• Group sync: Turn on to read group claims from this IdP's tokens. See Configure group sync for external IdPs — this only does something useful for a limited set of providers.
• JIT provisioning: Turn on to auto-create end users the first time they sign in through this IdP.

Edit, disable, or delete an IdP

1. Go to Account (the avatar at the top right of the page), and then select Security.
2. On the left, go to End users → Authentication.

3. Find the IdP in the External identity providers section.

   

4. To edit: Click the IdP to open and change the name, routing mode, domains, or OIDC credentials. Changes apply immediately to new sign-ins; active sessions aren't invalidated until the next token refresh.
5. To disable: Use the switch to temporarily stop sending end users to this IdP. Disabled IdPs won't accept new sign-ins. Existing JIT-linked end users keep their records but need a different auth path on their next sign-in, like Celigo credentials, if available.
6. To delete: Click the delete icon adjacent to the IdP to permanently remove the IdP configuration. This action can't be undone. If you want to use the IdP again, you must configure it again using Add IdP. End users who authenticated through the deleted IdP keep their end-user records and group memberships, but lose the link to the IdP sub. To regain access, they must be re-invited or authenticate through another configured IdP (with JIT re-linking them).

View active authentication methods

Go to Account (the avatar at the top right of the page), and then select Security. On the left, go to End users → Authentication:

• Celigo credentials: Always shown, with whether MFA is required and a summary of the MFA configuration.
• External identity providers: A list of configured IdPs with name, routing mode, domains, and group sync / JIT status. Each entry links to its detail page.

 If an end user forgets their Celigo password, use Forgot password? on the sign-in page.