Update the domain in a legacy SSO callback URL in the IDP environment

If your IDP authenticator for Aurora Endpoint Defense was created before June 2026, you might be using an SSO callback URL with a legacy domain for authentication. To ensure continuity for upcoming changes to the URL in June 2026, you need to add a separate callback URL in your IDP environment. The new callback URL uses an updated domain but with the same hash as the existing URL.

In your IDP environment, you must add a separate callback URL in the authenticator app settings if you are using a legacy SSO callback URL in one of these formats:

  • https://login.eid.blackberry.com/_/resume/saml20/<hash> to https://idp.cs.cylance.com/_/resume/saml20/<hash> (where <hash> is the hash value)
  • https://idp.blackberry.com/_/resume to https://idp.cs.cylance.com/_/resume (no hash value)
CAUTION: Do not remove the old URL. If it is removed before June 10, 2026, the configuration breaks. The SSO callback URL in the SAML authenticator in the Aurora Endpoint Security console stays the same and is updated to the new URL after June 10.