Set up SAML SSO

Guide

Enterprise SAML SSO per organization

SAML reference

You'll learn how to create a SAML connection, share metadata with your customer’s IdP, and route users by email domain.

For code-first setup, call options.AuthServer.SeedSamlConnection("stable-key", ...) and provide either metadata XML from host configuration or explicit entity ID, HTTPS SSO URL, and public signing certificate. The dashboard shows the result as code owned and leaves emergency enable/disable available; edit other fields in the seed. See SAML SSO: Code-first connection for the compiled example and reconciliation rules.

Goal#

Existing organization members with verified @acme.com email automatically use Acme’s SAML IdP instead of password login. New users are only created from SSO if you enable JIT provisioning.

Steps#

1. Open /sqlos/admin/auth/ → SSO / SAML for the target organization.
2. Create a draft SAML connection. Note the Entity ID and ACS URL SqlOS generates.
3. Send those values to the customer’s IT admin. If they should complete setup without global dashboard access, switch to the customer-managed SSO guide.
4. Import the IdP metadata XML (or paste certificate and endpoints manually).
5. Review the Access policy. The portal default requires SSO for existing members and leaves JIT provisioning off.
6. Enable the connection and set or verify the org email domain (e.g. acme.com).
7. Test with home realm discovery: sign in as an existing member with user@acme.com and confirm redirect to the IdP.

Expected outcome#

• SAML assertion links to an existing SqlOS user, or provisions access only when JIT is enabled
• Audit log shows SSO sign-in events
• Non-matching domains still use password, OTP, or social login

Next steps#

• Pair SCIM provisioning with SAML sign-in
• Let customer admins set up enterprise SSO
• Organizations
• Entra SSO testing notes (repo supplement)
• Troubleshooting SAML errors