Security & Compliance
Single sign-on
ArkCloud supports OAuth / OpenID Connect sign-in with Google, and with Microsoft Entra ID where it has been configured. SAML is built but switched off. This page states what each option does and how accounts are created.
Written for: Security reviewers · Administrators · Implementation teams
Providers
| Field or control | What it means |
|---|---|
| Available. OAuth with PKCE and state. Enabled on the hosted service. | |
| Microsoft Entra ID | Built on the server (OAuth with PKCE) and registered only when ArkCloud configures Microsoft credentials for the service. Not enabled on the hosted service today, and the sign-in page has no Microsoft button. |
| SAML 2.0 (Okta, OneLogin, ADFS and others) | Not available. ArkCloud does not yet verify SAML signatures, so every SAML assertion is refused and the setting cannot be switched on. |
| SCIM user provisioning | Not available. |
| Email and password | Always available alongside SSO; it cannot be turned off per organisation today. |
The sign-in page has a single "Continue with Google" button. It has no Microsoft button yet, so Microsoft Entra ID sign-in would also need that screen change before staff could use it.
How accounts are matched and created
| Field or control | What it means |
|---|---|
| Existing user | Matched by email address. The Google or Microsoft identity is linked to the existing ArkCloud account, which keeps its role and organisation. |
| New user | Created automatically on first sign-in, with the Agent role, only when the email domain is a verified domain of the organisation the sign-in resolves to, or is on the service's allowed-domain list. Otherwise sign-in is refused and an administrator must create the user first. An administrator then changes the role if needed. Demonstration organisations are the exception: they admit any address. |
| New user, no organisation (Google) | When the address has no account and no organisation can be identified for it, a Google sign-in becomes a sign-up: the person names a new organisation, accepts the terms and becomes its administrator, with the same 14-day trial and sample data as an email sign-up. Only a Google-verified address is accepted, and the organisation is created before any session exists - the person then signs in with Google as an existing user, so two-factor setup applies as usual. |
| Inactive or locked user | Refused while the account is inactive or the 15-minute lock is current. Once the lock has lapsed, Google sign-in clears it and succeeds, exactly as a password sign-in does. |
| Multi-factor authentication | Still applies. An administrator - or, when the organisation requires two-factor authentication for all users, anyone - who signs in with Google is asked for their ArkCloud second factor. |
Verifying a domain
Administration → Single Sign-On
- Add your email domain and copy the DNS TXT record the screen shows.
- Publish the record with your DNS provider.
- Choose verify. The domain is marked verified only when the DNS lookup finds the record.
The Single Sign-On screen also shows the provider list. Its Microsoft and Okta rows are labelled as not configured; configuring a provider there does not enable it.