Single Sign-On (SSO)

Skitflow Enterprise supports Single Sign-On through OpenID Connect (OIDC) and SAML 2.0, allowing your team to authenticate using your existing identity provider.

Supported Providers

• Auth0
• Keycloak
• Okta
• Azure AD / Entra ID
• Google Workspace
• Any OIDC or SAML 2.0 compliant provider

You can register multiple providers (e.g. one per identity provider or per email domain).

OIDC Configuration

1. Navigate to Settings → SSO and click Add provider
2. Select OIDC as the protocol
3. Provide:
   • Provider ID — a unique identifier for this provider (e.g. okta); it becomes part of the callback URL
   • Issuer URL — your identity provider's issuer URL (the discovery document is fetched from <issuer>/.well-known/openid-configuration)
   • Domains — one or more email domains that sign in through this provider
   • Client ID — the application client ID
   • Client Secret — the application client secret
   • Scopes (optional) — defaults to openid, email, profile if left empty
4. Configure the Redirect URI in your IdP: https://<your-instance>/api/auth/sso/callback/<providerId>
5. Click Save

SAML Configuration

1. Select SAML as the protocol
2. Provide:
   • Provider ID — a unique identifier for this provider; it becomes part of the callback URL
   • Issuer URL — your IdP's issuer
   • Email Domain — the email domain that signs in through this provider
   • IdP SSO URL — your IdP's SSO endpoint (entry point)
   • IdP Certificate — the IdP's X.509 signing certificate (PEM)
   • Callback URL and Audience (optional) — override the defaults if your IdP requires specific values
3. Configure the ACS URL in your IdP: https://<your-instance>/api/auth/sso/saml2/callback/<providerId>
4. Optionally download the SP metadata XML from the provider's menu to import into your IdP

User Provisioning

When SSO is enabled:

• New users are automatically created on first login
• User roles can be mapped from IdP groups to Skitflow roles
• Users can still use email/password as a fallback (configurable)