Single Sign-On (SSO) Setup

Single Sign-On Configuration

Enterprise customers can enable SSO for streamlined authentication using your existing identity provider.

Supported Providers

We support:

• Okta
• Azure Active Directory
• Google Workspace
• OneLogin
• Auth0
• Custom SAML 2.0 providers

Prerequisites

• Enterprise plan
• Admin access to your IdP
• Domain verification

Setup Process

1. Contact support to enable SSO
2. Provide your domain name
3. Receive SSO configuration details
4. Configure your IdP with our details
5. Provide us with your IdP metadata
6. Test SSO with a pilot user
7. Enable for all users

Configuration Details

You'll need:

Entity ID: https://example.com/sso
ACS URL: https://example.com/sso/acs
SLO URL: https://example.com/sso/slo

User Provisioning

Automatic user provisioning via SCIM:

• Auto-create users on first login
• Sync user attributes
• Update user information
• Deactivate users

Group Mapping

Map IdP groups to roles:

• Admin group → Admin role
• Developer group → Member role
• View-only group → Viewer role

Just-in-Time Provisioning

Users created automatically when:

• They sign in via SSO for the first time
• Their email domain matches verified domain
• They're assigned to app in IdP

Testing SSO

1. Use test user credentials
2. Visit your SSO login URL
3. Verify redirect to IdP
4. Complete IdP authentication
5. Confirm redirect back to our platform
6. Check user created with correct role

Troubleshooting

Common issues:

• SAML response invalid: Check certificate
• User not found: Enable JIT provisioning
• Wrong role assigned: Review group mappings