SSO Setup Workflow Guide for Cloud Customers
13/10/2026
This workflow outlines the step-by-step process for integrating external Identity Providers (IdP) with Graph Modeling (formerly PoolParty) via SAML v2.0 Single Sign-On (SSO). The following guide applies to cloud-based environments only.
Note
While Graphwise cannot test every identity provider or protocol, we support customers in setting up their specific configurations. Compatible identity providers include Okta, OneLogin, Ping, Microsoft Entra ID (formerly Azure AD), ADFS, Duo, and Google SSO, among others.
Request Initiation: Submit an SSO enablement request through the Graphwise Support Portal.
Tip
If you already know your authentication and attribute requirements, you can provide the SAML metadata file during your initial SSO setup request submission to accelerate configuration.
The SSO login option is typically available directly on the Graph Modeling login page. However, if preferred, a redirect page can be set up that routes users directly to your designated IdP.
Template Exchange & Metadata Submission: Fill out the SSO Integration Questionnaire provided by the Graphwise Support Team. This form includes details of parameters and IdP configuration. You also need to submit either a SAML Metadata File or initial SAML Response.
The template includes the following metadata:
Relevant URLs: The following URLs are examples of the URLs required to generate the SAML metadata file for SSO configuration. Providing these URLS during your initial SSO configuration request allows the support team to begin populating these entries.
Graph Modeling ACS URL:
https://login.<your-domain>.com/auth/realms/<your-realm>/broker/<your-idp-alias>/endpointGraph Modeling Entity ID:
https://login.<your-domain>.com/auth/realms/<your-realm>Descriptor URL:
https://login.<your-domain>.com/auth/realms/<your-realm>/broker/<your-idp-alias>/endpoint/descriptor
User Attribute & Claim Mappings: Provide the metadata file, exact SAML Attribute Names, or Claim URIs configured in your IdP for the following required user attributes:
First Name (e.g.,
firstName/givenName)Last Name (e.g.,
lastName/surname)Email Address (e.g.,
email/emailaddress)Username (e.g.,
preferred_username/nameidentifier)
Optionally, you can also provide mapping details for the following attributes:
Note
Specialized mapping logic (e,g,, custom roles) can be handled directly within the support ticket or during an alignment meeting.
Roles & Group Mapping Setup: You can define specific role or group mappings between your IdP and Graph Modeling. If not defined, a default configuration assigns users who authenticate with your company's email domain will be granted the ReadOnly role and assigned to a default Public group. A SuperAdmin can modify role, permission, and group assignments at any time.
SAML Security & Operation Parameters: Specify whether assertions should be signed. If yes, choose one of the following preferred authentication modes:
Import Mode (recommended): Imports user attributes, roles, and groups from the Identity Provider (IdP) only once (during the user's initial login to Keycloak). After this first login, Keycloak stops syncing role and group updates from the IdP. This allows a SuperAdmin to manually assign, remove, or modify roles and groups for the user directly within GraphModeling/Keycloak without the settings being overwritten during future sign-ins.
Force Mode: Updates user data during each user login.
Inherit Mode: Uses the sync mode configured in your identity provider. All other options will override this sync mode.
Note
For more information on how to configure Graph Modeling for SSO with Microsoft Entra ID, refer to the official Microsoft guide.
The choice and configuration of the Mapper Type depend on the assertions coming from your IdP. For more information, refer to the Keycloak documentation.
If you need to capture a raw SAML response during login, expand the subsequent section and perform the following steps:
Open your browser DevTools (F12 or Cmd+Option+I for MacOS; Ctrl+Option+I for Windows) and navigate to the Network tab.
Initiate the authentication flow by clicking your IdP (SSO) button on the Graph Modeling login page.
Locate the POST request sent to the Graph Modeling Keycloak endpoint in the network trace.
Select the request, navigate to the Payload tab, locate the
SAMLResponsekey under Form Data, right-click to copy its value, and attach it to your support ticket.
Keycloak Mapper Configuration: The Graphwise technical staff configures the identity broker, SAML realm parameters, and user attribute mappers in Keycloak based on the provided metadata payload.
Verification & Testing: The Graphwise support team coordinates a login test to confirm authentication, attribute translation and correct role inheritance.