SSO / SAML
Configure enterprise single sign-on with SAML 2.0, OIDC, Okta, or Google Workspace.
Overview
Single sign-on (SSO) allows your team to authenticate with Koalr using your organization's identity provider (IdP). This centralizes access control, enforces your existing password and MFA policies, and simplifies onboarding and offboarding.
SSO is available on the Enterprise plan. Contact [email protected] to upgrade.
Navigate to Settings > SSO to configure single sign-on.
Supported providers
| Provider | Protocol | Notes |
|---|---|---|
| SAML 2.0 | SAML | Works with Okta, Azure AD, Google Workspace, and any SAML 2.0 compliant IdP |
| OIDC / OAuth 2.0 | OIDC | Works with Auth0, Okta, and custom identity providers |
| Okta (native) | SCIM | Direct Okta integration with SCIM provisioning |
| Google Workspace | Google SSO | SSO scoped to your Google Workspace domain |
Configuration
- Select your SSO Provider from the grid.
- Enter the required fields:
- Entity ID / Issuer -- the identifier URI of your IdP (e.g.,
https://your-idp.com/...) - SSO URL -- the IdP's sign-on endpoint (e.g.,
https://your-idp.com/sso/saml) - X.509 Certificate -- the public certificate from your IdP in PEM format
- Entity ID / Issuer -- the identifier URI of your IdP (e.g.,
- In your IdP, add the Koalr ACS URL (Assertion Consumer Service):
https://app.koalr.com/sso/saml/acs- Click Save Configuration.
Testing the connection
After saving, click Test Connection to verify that Koalr can communicate with your IdP. The test result will indicate success or display a diagnostic message if something is misconfigured.
Common issues:
- Certificate mismatch -- ensure the certificate pasted into Koalr matches the one configured in your IdP
- ACS URL not registered -- confirm that
https://app.koalr.com/sso/saml/acsis listed as an allowed reply URL in your IdP - Entity ID mismatch -- the Entity ID in Koalr must exactly match the issuer value in your IdP metadata
Removing SSO
Click Remove to delete the SSO configuration and revert your organization to standard email/password and OAuth authentication. Members will need to sign in with their Koalr credentials or a connected OAuth provider (GitHub, Google) after SSO is removed.
User provisioning
When SSO is configured, users who authenticate through your IdP for the first time are automatically provisioned in Koalr. Their email address is matched to existing accounts where possible. With the Okta native integration, SCIM provisioning handles user creation and deactivation automatically.