Skip to main content

SAML SSO Configuration Guide

This guide explains how to configure SAML Single Sign-On for your enterprise account

Written by Zeyd (Co-founder)

NOTE: Once configured, SSO is enforced for all users who have been invited to your organization, and have email addresses matching the allowed domains.

Required Fields

Allowed Domains

Comma-separated list of email domains allowed for SSO.

Example: acme.com, acme.io

Entity ID

The unique identifier from your Identity Provider.

Configuration Method

Provide either a Metadata URL or all three Manual Configuration fields.

Option A: Metadata URL (Recommended)

Federation metadata URL from your Identity Provider.

Option B: Manual Configuration

If you don't have a Metadata URL, provide all three fields below:

Field

Description

Example

SSO URL

Single Sign-On URL

SLO URL

Single Logout URL

X.509 Certificate

Public certificate from your IdP

Must include -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers

Attribute Mapping

Email Attribute

The SAML attribute containing the user's email. The default value works for most Identity Providers.

First Name Attribute (Optional)

Last Name Attribute (Optional)

Common Errors

Error

Solution

"Provider ID is required"

Enter your IdP's Entity ID

"At least one domain is required"

Enter at least one allowed email domain

"Invalid domain format"

Use company.com format, not @company.com

"Either Metadata URL or Manual Configuration must be provided"

Provide a Metadata URL or fill in all three manual fields

"X.509 Certificate must include BEGIN and END CERTIFICATE markers"

Include the full certificate with header and footer lines

Did this answer your question?