Ververica DocsVerverica Docs
Docs Home
Viewing docs for
BYOCNot available for Self-Managed

Creating an Organization and Configuring SSO

Applies toBYOC
2 min read
On this page

You set up SSO by converting an existing individual Ververica Cloud account into an organization, then configuring your identity provider. The account that starts the conversion becomes the Organization Owner.

Prerequisites

  • Access to an individual Ververica Cloud account.
  • Ownership of the email domain you want to associate with your organization. You need to verify this domain before you can finish setting up the organization.

What happens when you convert

When you convert your individual account into an organization, Ververica Cloud migrates the following automatically:

  • Your workspaces.
  • Your subscriptions, payment information, and usage and credit history.
  • Guests you've invited, and any pending invitations you've sent or received.
  • Your registered agents.

Converting is permanent: you can't revert an organization back to an individual account.

Ververica Cloud also provides four permanent Organization Teams. As Organization Owner, you link each one to an SSO Group so the right people in your identity provider get administrative access.

Organization Creation

  1. From your individual account, start the "Convert to organization" flow. If you leave partway through, some fields become uneditable once you resume.
Account Settings page showing the Account Type section with a Create an Organization button
  1. Enter your organization name, slug, domain, and logo.
Create Organization wizard, step 1: Organization Details form with Name, Slug, Domain, and Logo fields

Domain Verification

Verify ownership of your organization's email domain, either with a DNS TXT record or by uploading an HTTPS file to your domain. Both domain and SSO verification show as in-progress steps until they clear.

  • DNS TXT record: add a TXT record to your domain's DNS settings, using the hostname and key values Ververica Cloud generates for you.
  • HTTPS file: download the generated verification file and upload it to the root of your domain.
Organization Settings page showing Domain Verification with DNS TXT record and HTTPS file upload options

SSO Configuration

Choose an SSO protocol, OIDC or SAML, and enter your identity provider's connection details as part of the same wizard.

Choose a protocol

Ververica Cloud supports two SSO protocols:

  • OpenID Connect (OIDC): Discovery URI, Client ID, Client Secret, Groups Claim.
  • SAML: your identity provider's metadata XML file. Download it from your identity provider (most provide a button for this) and upload it here; Ververica Cloud reads everything else it needs from that file.

Pick whichever your identity provider uses. Most modern identity providers support OIDC; SAML remains common in some enterprise environments.

Once you choose a protocol, Ververica Cloud also shows you reference values to enter on your identity provider's side: a callback URL for OIDC, or an SP Entity ID and callback URL for SAML.

Create Organization wizard, step 2: SSO Settings form for OpenID Connect, with Discovery URI, Client ID, Client Secret, and Groups Claim fields
Create Organization wizard, step 2: SSO Settings form for SAML 2.0, with Callback URL, SP Entity ID, and IdP Metadata fields
Create Organization wizard, step 2, filled in with example OIDC values

Finishing Up

Once the organization setup is finished, you can start creating Teams to manage access to your workspaces.

Until you configure SSO, you and other administrators keep using password sign-in to finish setup.

Organization Welcome page showing setup progress, with Domain Verification complete and Single Sign-On Verification in progress
Was this helpful?