Single sign-on and directory sync

On the Enterprise plan, owners connect the organization's identity provider (IdP) on the Enterprise page (main navigation, owners only). Members then sign in through the IdP with SAML 2.0 or OpenID Connect, and the IdP can create, update and remove members through directory sync (SCIM 2.0).

Setting up a connection

1. On Enterprise → Single sign-on, choose the protocol, a name and your email domain (for example example.org). A domain belongs to one organization only.
2. For SAML, give the IdP the ACS URL and Entity ID the page shows, then fill in the IdP's metadata URL, or its sign-in URL, entity ID and signing certificate. For OpenID Connect, enter the issuer and client ID; the connection itself is created in the identity provider's dashboard, and its ID goes in Connection ID.
3. Test sign-in: sign in through the IdP once. The page records when the test passed.
4. Activate. Nothing is enforced yet: members can still sign in as before.

On a test or development deployment, a built-in test IdP stands in for yours: Test sign-in as takes an address on your domain and signs it in at once. Nothing leaves the deployment.

Enforcing SSO

Under Enforcement, Members must sign in through the IdP refuses every member who has not signed in through it: the app sends them to the Single sign-on page, where they sign in through the IdP and continue. Owners may still sign in without it keeps a way back in if the IdP fails; leave it on unless your policy forbids it.

Enforcement stops if the plan lapses, so a downgrade never locks anyone out. Turning a connection off (Deactivate) stops enforcement at once.

Directory sync (SCIM)

1. Under Directory sync, copy the SCIM base URL into your IdP's provisioning settings.
2. Create a token and paste it into the IdP as the bearer token. It is shown once; Replace the token issues a new one and the old one stops working.
3. Choose the Role for new members. IdP roles can be mapped to app roles; directory sync never grants or removes the owner role.

The IdP then creates users (they become members when they first sign in with that email), updates them, and removes them. Removing or deactivating a user in the IdP ends their access at once and revokes the roles directory sync granted; the record is kept, marked removed. The last owner is never removed. Every change is in the audit log as the directory, not a person.

The SCIM endpoints answer only the directory-sync token; a member's own session gets "not found" there.

Who can do what

Owners configure SSO and directory sync. Every member can open the Single sign-on page to see whether SSO applies to them and sign in through the IdP.