PXCMailAdmin
Prototype · sample dataMA
Security › Single sign-on

Single sign-on

Hosted Pro · SAML 2.0 or OIDC · users keep MFA at the identity provider · one break-glass owner stays on password + security key.

  1. Choose provider
  2. Exchange metadata
  3. Attributes & provisioning
  4. Test
  5. Roll out
Identity providerOkta · SAML 2.0 · app “PXCMail”
Our values for the IdPACS URL https://sso.pxcmail.com/saml/acs · Audience https://sso.pxcmail.com/saml/lakesidedental · NameID: email
IdP metadataUploaded Oct 18 · certificate expires Mar 2028 · replace
Valid
Attribute mappingemail → email · firstName/lastName → name · groups → role (pxc-admins=Admin, pxc-compliance=Compliance, else User)
Edit
Just-in-time provisioningCreate a PXCMail user on first SSO sign-in (seat counted) · remove when removed from the Okta app
Trust the IdP’s MFASkip PXCMail’s MFA prompt when the assertion carries an MFA AuthnContext (avoids double prompts)
EnforcementPilot group first (3 users), then everyone; password sign-in stays for the break-glass owner
Break-glass owner[email protected] · security key enrolled · alerts Security Officer when used
Ready

Back to Security

Test results

Passed

Test sign-in succeeded for [email protected]

Assertion signed · audience matches · clock skew 0.4 s · NameID email · groups: pxc-compliance → role Compliance · MFA context present (PXCMail prompt skipped).

Re-checked every 5 min · we email you when it clears

Prototype states: tested · test-audience · test-clock · test-cert · test-assign · ticket