ContraxContrax

Summary: Contrax Enterprise can require company SAML or OIDC login via Clerk. Contrax enforces that IdP on dashboard pages and tenant APIs; you still create the connection in the Clerk Dashboard.

Enterprise SSO (Clerk SAML / OIDC)

Contrax uses Clerk for authentication. SAML and OIDC connections are configured in Clerk (Okta, Entra ID, Google Workspace enterprise, etc.). Contrax stores the workspace flag ssoEnforced and allowed email domains, then rejects dashboard pages and tenant API calls that did not arrive via that IdP.

Setup checklist

  1. Upgrade the workspace to Enterprise (sales / founder provisioning via POST /api/organizations/enterprise).
  2. In Clerk Dashboard → SSO connections, add the customer SAML or OIDC IdP. Social logins (Google/GitHub buttons) are not Enterprise SSO.
  3. In Contrax Workspace → Settings, add allowed domains (e.g. acme.com).
  4. Enable Enforce SSO.

Enforcement behavior

When SSO is on for an Enterprise org, dashboard pages and API access require:

  • A Clerk SAML or enterprise OIDC external account on the user, and
  • If domains are set, a matching email domain.

Password or social logins are redirected to /sso-required (HTML) or rejected with HTTP 403 (APIs). Founder admin emails listed in FOUNDER_ADMIN_EMAILS are break-glass and may still access.

Related: Enterprise plan · Security pack · Licensing & SLA

Frequently asked questions

Which SSO protocols does Contrax Enterprise support?

SAML and OIDC via Clerk Enterprise connections. Contrax enforces the IdP on dashboard pages and tenant APIs (social logins are rejected). Allowed email domains are configured in Workspace settings.

Your IT administrator following the Enterprise SSO doc, with Contrax support available on Enterprise plans.