Single Sign On

Single Sign-On (SSO) lets you manage Makaira access with Microsoft Azure Active Directory. Users sign in with your company identity instead of a Makaira password. Their Makaira roles still match the default roles in Role Manager: Administrator, Shop Manager, Content Creator, and Owner.

To set up the connection, register an app in Azure AD and share the credentials with Makaira. Then map Azure AD groups to Makaira customers, instances, and roles.

There are two mapping modes.

Legacy static mapping

Azure AD groups are translated with a customer-specific mapping configured together with Makaira. This applies to Azure AD users (user IDs that do not use the default auth0| prefix). Groups are taken from the user’s groups claim.

If you already run SSO this way, keep using the groups Makaira configured for you. New setups should use the dynamic notation below.

Dynamic group notation

Azure AD groups can follow a fixed recipe. The prefix is Mak. Sections are separated with __. Lists inside a section use --.

Mak__Customer__Instance1--Instance2__Rolename1--Rolename2

• Customer is the Makaira customer key (the subdomain, for example stage for stage.makaira.io).
• Instances are instance identifiers such as live or staging. Use * or all for every instance.
• Role names are the short names (ADMIN, SHOPMANAGER, CONTENTCREATOR, OWNER), not Makaira.ADMIN.

Example: access to customer stage, instance live, role Administrator:

Mak__stage__live__ADMIN

Example: customer stage, all instances, Shop Manager and Content Creator:

Mak__stage__all__SHOPMANAGER--CONTENTCREATOR

Makaira looks for this notation in Azure AD groups and, when present, in app_metadata.sso_groups. Matching groups are translated into instance role assignments, for example:

{
  "domains": {
    "stage": {
      "live": ["rol_XXXXXXXXX"]
    }
  }
}

You can migrate from static mapping by putting the dynamic notation on your Azure AD groups.