Constellix supports Service Provider (SP) and Identity Provider (IdP) initiated SSO. After SAML is enabled, users enter their email address, are redirected to the IdP, and authenticate there.

Heads up: When SAML is enabled for an account, local login is disabled. Maintain a non‑SAML “break glass” user for continuity if your IdP is unavailable.

No. Existing permissions are retained for current users.

Newly provisioned SAML users have no permissions by default. Assign permissions manually within the Constellix control panel.

At this time, permissions and groups cannot be assigned from your IdP; they must be configured in Constellix.

For SAML‑enabled accounts, the email address is the username.

A “break glass” account is a non‑SAML administrative user kept for emergencies (e.g., IdP outage). Use a regular username (no domain) and secure it with strong MFA and vaulting.

1. Add the user as a standard user in Constellix (if they don’t already exist).
2. Open Manage Users and provision SAML for that user.

Constellix also supports Just‑In‑Time (JIT) provisioning from your IdP.

This workflow differs from DNS Made Easy. In Constellix, you create a standard user first, then enable SAML for that user.

No. New users—whether created via UI or JIT—start with no permissions and require manual assignment in Constellix.

1. Complete the provided Google Form with your IdP metadata and details.
2. Our DevOps team installs the configuration.
3. For new installations, a SAML service restart is required. To ensure stability, restarts are scheduled on Tuesdays and Thursdays.

At this time, disabling a SAML user is not available in the UI. If you share the username, we can coordinate with our SAML administrator to disable SAML for that user on your account.

A self‑service UI option is planned for a future release.

You can reprovision the user in your IdP and SSO should work. If you delete and recreate the user in Constellix, they’ll need to re‑confirm their email and may need to reset their password.

• Platinum: No fee.
• Gold & Standard: $250 one‑time setup + $100/month after activation.

The fee applies per account, not per SAML user.

At this time, SCIM is not offered. Constellix supports SAML‑based SSO.

Both are supported, and the necessary SAML bindings for redirection are built in.

Yes. New users can be created in the UI or provisioned via your IdP using Just‑In‑Time provisioning.

At this time, role‑ or group‑based provisioning from the IdP is not offered. Newly provisioned users start with no permissions and must be granted access within Constellix.