Skip to content

Set up single sign-on

Single sign-on (SSO) lets your members sign in to Elaichi with your company’s identity provider, such as Okta or Microsoft Entra ID, over OIDC or SAML. You can also route verified email domains to the right provider and require SSO for those domains.

Where to find it: Settings → SSO and SCIM

Before you start

Requirement Details
Permission Manage SSO (sso:manage) to create, change, or delete anything. View SSO (sso:view) lets you see the page but not change it.
Plan Gold or Black. On other plans the tab shows “SSO isn’t in your plan”.
Domain At least one verified domain to route sign-ins to your provider.

In the app, Elaichi asks you to confirm it’s you when you create or edit a connection.

How the pieces fit together

When a member types a work email address, Elaichi looks up the domain, finds the SSO connection linked to it, and sends the member to your identity provider. After the provider confirms the sign-in, the member is in Elaichi. SCIM and group role mappings, on the same page, keep membership and roles in sync with your directory.

How SSO and domains fit together 
flowchart TD
  Email["Member enters work email"] --> Resolve["Domain routing"]
  Resolve --> Conn["SSO connection<br/>OIDC or SAML"]
  Conn --> IdP["Identity provider"]
  IdP --> Session["Signed-in Elaichi session"]
  SCIM["SCIM provisioning"] --> Members["Organization members + groups"]
  Members --> Map["Group role mappings"]
  Map --> Roles["Elaichi roles"]

What is on this page

Section What you do there
SSO connections Create OIDC or SAML connections. Turn them on, require them, or make one the default.
Domain routing Link each verified domain to a connection, or to the organization default.
SCIM provisioning Copy the SCIM base URL and manage SCIM tokens. See Provisioning members with SCIM.
Group role mappings Map each SCIM group to one Elaichi role.

Create a connection

A connection starts switched off, so you can finish setup before anyone uses it.

  1. Open Settings → SSO and SCIM.
  2. Click New connection.
  3. Choose the Protocol, either OIDC or SAML. You cannot change the protocol later.
  4. Enter a Name, such as Okta, and create the connection.
  5. Reopen the connection. Under Configure these URLs in your identity provider, copy each URL into your provider’s app settings.
  6. Fill in the provider details for your protocol (see below).
  7. Optional: choose a Default role for provisioned members. If you leave it empty, new people get Member.
  8. Switch Active on, then click Save connection.

If a required field is missing, Elaichi refuses to activate the connection and reopens the form so you can finish.

You will see the connection in the SSO connections table with Active on.

OIDC details

Field Notes
Issuer / discovery URL The OIDC issuer of your provider
Client ID From your provider’s app
Client secret Stored encrypted. When you edit a connection, leave it blank to keep the stored secret.

SAML details

Paste your provider’s Identity provider metadata XML to fill the fields, or enter them yourself.

Field Notes
Identity provider entity ID From your provider
Identity provider SSO URL From your provider
Identity provider X.509 certificate From your provider
Sign AuthnRequests Switch on if your provider requires signed requests
Allow identity provider-initiated login Switch on to let sign-in start from your provider

Connection switches

Switch What it does
Active Lets members sign in with this connection.
Default connection Used by members whose domain is not linked to a connection, and by domains set to Org default.
Enforce SSO Members at linked verified domains must sign in with SSO. Sign-in with Google, GitHub, Microsoft, and email codes is refused for them. Works only while the connection is active.

In the table you can switch Active and Enforced on or off, edit a connection, delete it, or choose Make default. Make default appears on active connections that are not already the default.

  1. Verify the domain under Settings → Domains.
  2. Open Settings → SSO and SCIM → Domain routing.
  3. In the domain’s row, choose a connection, or choose Org default.

Only verified domains appear here. Sign-in cannot find your identity provider for an email address until its domain is linked.

Roll out SSO safely

  1. Create the connection while it is off, and finish the provider setup.
  2. Link a verified domain, or make the connection the default.
  3. Switch Active on and test sign-in with a real account.
  4. Only then switch Enforce SSO on.

Delete a connection

  1. Link the domains that use it to another connection first.
  2. In the table, open the row menu and choose Delete.
  3. Confirm.

Members who use the connection lose access immediately. Deleting a connection cannot be undone.

What to know

  • You can have more than one connection, for example one identity provider for each domain.
  • If you enforce SSO before the provider works, members at those domains cannot sign in. Test first.
  • SCIM works without SSO sign-in, but most teams use both. See Provisioning members with SCIM.