Administration/Sign-in
Single sign-on (SAML)
Create a SAML connection in Admin Center, configure your IdP, and enable SSO on a deployment.
Use this article to connect your identity provider with SAML single sign-on (SSO) and let members sign in with "Continue with {connection name}" on your workspace login page.
SAML SSO is an add-on. Your plan must include SSO / SCIM, and a workspace admin must turn on SSO / SCIM under Settings → Advanced before members can use SSO on that workspace.
What you configure where
SAML connections are created at the "organization" level. Per-deployment settings choose which connections are active and how strictly SSO is enforced.
| Location | Purpose |
|---|---|
| Admin Center → "Identity" → "SSO Connections" | Create and manage SAML connections |
| Admin Center → "Deployments" → "Advanced" | Enable sign-in methods and SSO enforcement for one deployment |
| Settings → Advanced (workspace app) | Turn on the SSO / SCIM add-on for that workspace |
Create a SAML connection
- Open Admin Center → "Identity".
- On the "SSO Connections" tab, click Add Connection.
- Enter a "Display Name" (for example
Corporate OktaorPartner Azure AD). - Copy these values into your identity provider:
- "Identifier (Entity ID)"
- "Reply URL (ACS)" (format:
https://{api-host}/auth/saml/acs)
- Import or paste your IdP details:
- "Metadata URL", or
- "IdP Entity ID", "IdP SSO URL", and "IdP Certificate(s)"
- Under "Assign to Deployments", select the deployments that may use this connection.
- Save the connection.
The connection list shows "Active ({n})" or "Inactive" badges per connection.
Enable SSO on a deployment
-
In Admin Center, open Deployments → your deployment → "Advanced".
-
Turn on Continue with SSO ("Allow users to sign in with organization SSO").
-
Under "SSO settings", choose SSO Enforcement:
Mode Label Effect Optional "Optional" Members can use Google, mail, Microsoft, or SSO All users "Required for all" Only SSO works; Google, mail, and Microsoft toggles are disabled Selected domains "Required for selected domains" Listed email domains must use SSO; others keep optional methods -
If you chose "Required for selected domains", enter comma-separated domains in "Required domains" (placeholder:
example.com, another.com). -
Enable the SAML connection(s) you want active for this deployment.
Also turn on SSO / SCIM in the workspace app under Settings → Advanced so the workspace accepts provisioned and SSO users.
How members sign in with SSO
Members open your workspace login URL, enter their email, and Click Continue with {your connection display name} on the method picker.
When SSO is listed alongside other methods, an "Or" separator appears between SSO and Google, mail, or Microsoft options.
SAML and custom domains
OAuth and SAML callbacks run through Clipido's managed auth hosts, then return session cookies to your custom domain through a short auth handoff. Members should start sign-in on the hostname they plan to use (your custom domain or default subdomain).
If SSO works on the default subdomain but not on a custom domain, the custom domain may not be fully live yet, or the member started sign-in on a different host.
Plan and toggle requirements
SSO requires both the SSO / SCIM add-on on your plan and the SSO / SCIM toggle enabled under Settings → Advanced.
If the plan does not include SSO, Settings → Advanced shows an "Upgrade" button instead of the toggle. If the plan includes SSO but the toggle is off, members cannot use SAML even when connections exist in Admin Center.