This guide explains the one-time Enterprise Single Sign-on (ESSO) setup that every enterprise customer completes before using the IndyKite platform. It covers what to register in your identity provider (IdP), what the Hub setup form asks for, and what happens after the first sign-in.
What is Enterprise Single Sign-on?
Enterprise Single Sign-on (ESSO) connects the IndyKite Hub to your company's identity provider. Once it is configured, you and your colleagues sign in to the Hub with your existing corporate accounts - there are no separate IndyKite passwords to manage.
ESSO is bound to your company's email domain. Anyone who opens the Hub and signs in with an email address on that domain is sent to your IdP to authenticate.
Supported identity providers:
- Microsoft Entra ID (formerly Azure AD)
- Keycloak
- Auth0
Is ESSO the same as Token Introspect?
No. Both involve an external IdP, but they solve different problems:
| ESSO | Token Introspect | |
|---|---|---|
| Who signs in | Your team, the people who administer the platform | The end users of the applications you build on IndyKite |
| Where | The IndyKite Hub (web console) | IndyKite REST APIs (AuthZEN, ContX IQ) called with a user access token |
| Configured | Once per company, on the Hub setup page | Per project, via the Config API, Terraform, or the Hub |
| Result | Access to organizations, projects, and credentials | A token is mapped to an identity node in the IKG |
Token Introspect Guide: https://developer.indykite.com/guides/guide-token-introspect
Sandbox or enterprise Hub: which one am I using?
The IndyKite Hub at eu.hub.indykite.com and us.hub.indykite.com serves two kinds of accounts. ESSO applies only to the second:
| Sandbox | Enterprise Hub with ESSO | |
|---|---|---|
| Who can get in | Anyone. Register with a personal account, no contract needed. | Customers with an IndyKite contract, invited by email. |
| How you sign in | Sandbox login created at registration. | Your company's IdP, via ESSO. |
| Organization | Provided for you, sandbox-hosted database. | You create it and choose IndyKite-hosted or Customer-hosted Neo4j. |
| Purpose | Explore and prototype. | Production workloads under your contract. |
To explore without a contract, follow the Sandbox guide instead of this one.
Prerequisites
- An invitation email from IndyKite. Click Accept invitation (or the direct link) to open the Hub setup page. Contact IndyKite if you have not received the email or if the invitation has expired.
- Administrator access to your IdP, so you can register an OAuth 2.0 / OpenID Connect application and generate a client secret.
- The regional Hub URL you were invited to. Use the same region for the Hub, the APIs, and your data:
- EU Region:
https://eu.hub.indykite.com - US Region:
https://us.hub.indykite.com
- EU Region:
Step 1: Register an application in your IdP
In your IdP, create a web application (confidential client) for the IndyKite Hub. The one setting that must be exact is the redirect URL (also called callback URL or reply URL). It is provider-specific and regional:
| IdP | Redirect URL (EU Hub) |
|---|---|
| Entra ID | https://eu.hub.indykite.com/api/auth/callback/azure-ad |
https://eu.hub.indykite.com/api/auth/callback/google |
|
| Keycloak | https://eu.hub.indykite.com/api/auth/callback/keycloak |
| Auth0 | https://eu.hub.indykite.com/api/auth/callback/auth0 |
For the US Hub replace eu.hub.indykite.com with us.hub.indykite.com. A wrong region or path is the most common cause of a "redirect URI mismatch" error from the IdP.
Then collect the values the Hub form will ask for (see Step 2) and generate a client secret.
Provider documentation:
- Entra ID: Register an application
- Google: Google Sign-In
- Keycloak: Keycloak
- Auth0: Auth0 applications
Step 2: Fill in the ESSO form
On the Hub setup page, select your IdP from the dropdown on the right of the welcome page, fill in the form, and click Set up ESSO.
What does each provider ask for?
| IdP | Field | Where to find it |
|---|---|---|
| Entra ID | Directory (tenant) ID | The ID of your Microsoft Entra tenant |
| Application (client) ID | The Application (client) ID of the app you registered | |
| Application (client) secret | A secret generated for the app in the Microsoft Entra Admin Center (Azure Portal) | |
| Client ID | The client ID of the OAuth application you registered in Google | |
| Client Secret | A secret generated for that application | |
| Keycloak | Issuer URL | The issuer value published at https://[keycloak_server]/realms/[realm]/.well-known/openid-configuration |
| Client ID | The client ID of the application you registered in the realm | |
| Client Secret | A secret generated for that client | |
| Auth0 | Issuer URL | Your Auth0 tenant's issuer, used to validate tokens and discover signing keys |
| Client ID | The client ID of the application you registered in Auth0 | |
| Client Secret | A secret generated for that application |
The Issuer URL is what the Hub uses to verify that tokens come from a trusted source and to fetch the IdP's metadata, such as signing keys. Providers with a fixed, well-known issuer (Entra ID, Google) do not ask for it.
The client secret allows authentication on behalf of your application. Keep it in your own secret manager, and never expose it in screenshots or shared documents. The Hub does not show it again after setup.
Step 3: Sign in for the first time
When the IdP details are validated you land on the Ready to go! page. Click Sign in and authenticate with your IdP. From now on, everyone with an email address on your company domain signs in to the Hub the same way.
Step 4: Create your organization
After the first sign-in the Hub prompts you to create an organization, the top-level account that represents your company. It holds your projects, applications, application agents, and service accounts.
- Enter the organization Name and an optional Description.
- Select a database hosting option. It applies to every project in the organization and cannot be changed afterwards:
- IndyKite-hosted: IndyKite provisions and manages the Neo4j database for you. No infrastructure setup is required.
- Customer-hosted: you provide and manage your own Neo4j instance, with full control over data residency and infrastructure.
- Optionally add a project, or click Add later. You need at least one project before onboarding data or creating application credentials.
You are then taken to the Projects page, with your new organization visible in the left navigation bar.
Getting started in the Hub
Once ESSO and your organization exist, open your regional Hub (https://eu.hub.indykite.com or https://us.hub.indykite.com), sign in with your corporate account, and work through these steps in order. Each one depends on the previous.
- Create a project. Go to Projects in your organization menu and click New. Give it a unique name and an optional description. Projects are isolated from each other; use one per environment or product.
- IndyKite-hosted: choose the region (single or multi-region), the location (US or Europe), and the memory size. Region and location cannot be changed later; size changes go through IndyKite support.
- Customer-hosted: provide the connection URL and administrator credentials of your Neo4j instance, reachable from the IndyKite platform. One Neo4j instance serves one project.
- Create a service account and download its credentials. At the organization level, open Service accounts, create one, and create credentials for it. These authenticate the Config API and Terraform.
- Create an application and an application agent. Inside the project, create an Application, then an Application Agent under it with the API permissions you need, then create credentials for the agent. These authenticate every runtime API: Capture, ContX IQ, AuthZEN, and Data Schema.
From here you can ingest data and author policies. The details of each object and permission are in the Environment guide, and the credential files and headers are in the Credentials guide.
What happens after setup?
| Question | Answer |
|---|---|
| How is a user routed to my IdP? | By the domain of the email address they sign in with. One ESSO configuration serves one company domain. |
| Can we have several organizations? | Yes. Organizations created by your company share the same ESSO configuration; ESSO is set up once, not per organization. |
| Can I edit the ESSO configuration? | The Hub does not offer self-service editing after setup. To switch providers, rotate a client secret, or remove the configuration, contact IndyKite support. |
| Does ESSO give API access? | No. APIs use Service Account and Application Agent credentials, which you create in the Hub after signing in. See the Credentials guide. |
Troubleshooting
| Symptom | Likely cause and fix |
|---|---|
| No invitation email, or the link says the invitation has expired | Invitations are issued by IndyKite. Contact IndyKite to receive a new one. |
| The IdP reports a redirect URI mismatch | The redirect URL registered in the IdP does not match the Hub's callback exactly. Check the region prefix (eu vs us) and the provider path segment (azure-ad, google, keycloak, auth0). |
| Set up ESSO is rejected | The IdP details could not be validated. Re-check the tenant ID or issuer URL, the client ID, and that the client secret was copied in full and has not expired. |
| A colleague is not sent to our IdP when signing in | Their email address is not on the domain the ESSO configuration is bound to. Have them sign in with their corporate address. |
| We want to try the platform without a contract or a corporate IdP | Register for the Sandbox, which is open to everyone and needs no ESSO. See the Sandbox guide. |
Next Steps
- Organizations, projects, and applications: Environment Guide
- Service Account and Application Agent credentials: Credentials Guide
- Validate your end users' tokens: Token Introspect Guide
- Manage projects as code: Terraform Guide