Skip to main content
Empuls provides secure, enterprise-grade user authentication through a combination of SSO with customers’ identity providers and hardened local account controls, ensuring that only authorised your organisation users can access the platform.
Empuls provides secure, enterprise-grade user authentication through a combination of SSO with customers’ identity providers and hardened local account controls, ensuring that only authorised your organisation users can access the platform.
  1. LDAP / Single Sign-On (SSO) using modern protocols
  • Empuls acts as a SAML 2.0 / OAuth2-OIDC Service Provider and integrates with your organisation’s existing AD/LDAP infrastructure via your chosen IdP (e.g., ADFS, Azure AD, Okta). The Empuls architecture explicitly supports “SSO/Active Directory” for seamless login.
  • Typical SAML configuration includes: ◦ Exchange of SAML metadata (SP entity ID, ACS URL, certificate) between Empuls and your organisation’s IdP. ◦ Mapping of NameID and email/user IDs to Empuls accounts, plus optional group/role claims for role mapping. ◦ Enforcement of signed SAML assertions and HTTPS/TLS 1.2+ for all SSO traffic.
  • For OAuth2/OIDC SSO (e.g., Office 365 / Google Workspace), the customer can directly enable SSO from the Empuls admin console and bind Empuls to the IdP’s authorization and token endpoints.
  • Authentication is therefore delegated to your organisation’s directory and IdP, which can enforce your own password, MFA, device, and network policies centrally.
  1. Security of local Empuls accounts (when SSO/LDAP is not used) When SSO is not enabled (or for break-glass admin accounts), Empuls uses hardened local authentication with the following controls:
  • Strong password policy - Local accounts follow the corporate Password Management Policy, which requires complex passwords (mix of upper/lowercase, numbers, and special characters) with minimum length thresholds, password history, and maximum password age to ensure regular rotation.
  • Account lockout & misuse protection - Accounts are automatically locked after a limited number of unsuccessful login attempts (e.g., 5 tries), and can be unlocked only after the user’s identity is verified by the IT/Support team.
  • Secure password storage - All application passwords are stored only in hashed and salted form; files containing password hashes are accessible only with elevated administrator privileges, as mandated by the Information Security Policy.
  • MFA for local accounts - Where SSO is not used, Empuls can enforce multi-factor authentication (e.g., OTP-based second factor) for admin and sensitive accounts, significantly reducing the risk of credential compromise.
  • Operational controls - Password sharing is prohibited; users are instructed not to store or disclose passwords, and incidents involving suspected credential exposure are escalated through the incident management process.
Together, these controls ensure that your organisation can either fully leverage its existing LDAP/SSO stack for centralised, policy-driven authentication or rely on secure, MFA-protected local Empuls accounts that align with Xoxoday’s ISO 27001 and SOC 2 driven security policies. Learn more: Empuls Help Centre

Does Empuls support Single Sign-On (SSO) for employee login?

Empuls supports SSO via SAML and OAuth standards, letting employees log in with corporate credentials for secure, seamless access.

Does Empuls support Single Sign-On and MFA for secure login?

Empuls supports SAML 2.0 and OAuth 2.0 SSO, connecting to your existing identity provider and honouring every MFA policy your IT team has configured.