Access the unified Portal to manage applications, organization configuration, and secure administrator access. This guide covers current sign‑in methods (Email & SAML SSO), rollout, and operational best practices. Google sign-in has been deprecated (@gmail domain).
Google sign-in (@gmail domain) has been deprecated and is no longer available. Migrate any residual flows to SAML SSO or Email + Password.
Email Login
Baseline credential access
SAML SSO
Centralized identity & governance
Provision
Auto user creation via SSO
Migrate
Link legacy accounts
Audit
Track access changes
Resilience
Maintain break‑glass account
Sign-In Options
Direct portal credentials (use for initial access or controlled break‑glass fallback).
SSO (SAML) Enablement Workflow
1
Engage Support
Contact support with org domain & desired scope (all users or whitelist subset).
2
Configure IdP
Set Assertion Consumer (Response) URL: https://amity-portal-prod-auth.amity.co/saml2/idpresponse
3
Audience Restriction
urn:amazon:cognito:sp:eu-central-1_gcJoCA15K
4
Attribute Mapping
5
Domain Sign-In
Users choose “Sign in with SSO”, enter org domain, redirected to IdP.
6
User Migration
Existing portal accounts linked to SSO identities post first successful SAML assertion.
Delete legacy direct admin accounts before activation if you want to strictly enforce SSO-only access.
Post-SSO Behavior
Automatic Provisioning
Automatic Provisioning
New SSO-authenticated users are created with default access model on first login.
Console User Creation Disabled
Console User Creation Disabled
Manual creation in Console is restricted to prevent identity fragmentation.
Legacy Accounts
Legacy Accounts
Existing non-SSO accounts remain functional unless explicitly removed.
Security Consolidation
Security Consolidation
Central revocation at IdP immediately prevents portal access.
Migration Tips
Inventory current admin users; decide which persist; communicate cutover date.
Metrics & Monitoring
| Metric | Purpose | Healthy Signal | Action Trigger |
|---|---|---|---|
| First Login Success % | Onboarding friction | ≥ 95% | Drop → review IdP attribute mapping |
| Legacy Account Count | Progress toward full SSO adoption | Trending to 0 | Flat > 0 for 2 cycles → enforce cleanup |
| SSO Provision Time | Automation latency | < 30s | Delays → check webhook / IdP latency |
| Failed SAML Assertions | Detect config issues | Near 0 | Spike → validate Audience / ACS URL |
| Duplicate Emails | Identity collision | 0 | Any → merge / remove stale account |
Troubleshooting
| Issue | Likely Cause | Resolution |
|---|---|---|
| SSO option not shown | Org not enabled | Confirm enablement with support |
| Assertion Consumer mismatch | Wrong ACS URL | Update IdP to official URL |
| Audience validation error | Incorrect Audience string | Use urn:amazon:cognito:sp:eu-central-1_gcJoCA15K |
| User loops back to login | Attribute (email) not mapped | Map email claim correctly |
| Duplicate account created | Case variation in email | Normalize email casing & merge |
| Cannot remove legacy account | Still active sessions | Terminate sessions then delete |
Best Practices
Least Privilege
Least Privilege
Leverage IdP groups to scope admin roles (avoid broad default grants).
Periodic Review
Periodic Review
Quarterly audit of active SSO users vs HR roster.
Break-Glass Access
Break-Glass Access
Maintain one monitored credential account for emergency (rotate often).
Communication Plan
Communication Plan
Notify administrators of SSO switch ahead of time with clear rollback steps.
Logging & Alerting
Logging & Alerting
Integrate portal login events into SIEM for anomaly detection.
Related
If you need assistance validating your SAML metadata, contact support with the IdP entityID and certificate fingerprint.