Documentation

Single sign-on & provisioning

Traceline is a standard SAML 2.0 Service Provider with SCIM 2.0 user provisioning. Any SAML 2.0 identity provider works; OIDC (Entra ID, Google Workspace, generic) is also supported. Setup is self-service: everything you need is on Settings → Single sign-on (org.manage required).

What you exchange

Traceline gives you	Where your IdP asks for it
Entity ID / Audience	Okta: “Audience URI (SP Entity ID)” · Entra: “Identifier (Entity ID)”
ACS URL	Okta: “Single sign-on URL” · Entra: “Reply URL (ACS URL)”
SP metadata URL	Keycloak / Google: import it instead of typing the two above
SCIM base URL + bearer token	Your IdP’s provisioning tab

Traceline needs back: the IdP sign-in URL, the signing certificate (PEM) and your email domain(s). Save, tick Enabled — from that moment, typing a matching work email on the sign-in page offers the SSO button.

Rules that hold for every IdP

The NameID (or an email attribute) must be the person's email, on an allowed domain.
Assertions must be signed — unsigned or wrongly-signed assertions are rejected, never “best-effort” accepted.
Just-in-time provisioning creates unknown users only if you enable it; the role comes from your group→role mappings (highest privilege wins, owner is unreachable).
SSO is an additional door: passwords, OTP and TOTP keep working.

Microsoft Entra ID (Azure AD)

Entra admin center → Enterprise applications → New application → Create your own → “Integrate any other application”.
Single sign-on → SAML. Identifier = Entity ID; Reply URL = ACS URL.
Attributes & Claims: keep defaults. To send groups, add a group claim (Security groups).
SAML Certificates → download Certificate (Base64) → paste into Traceline. Copy Login URL → IdP sign-in URL.
Provisioning → Automatic → Tenant URL = SCIM base URL, Secret Token = Traceline SCIM token. Test connection → Start provisioning. Deactivation revokes live sessions.

Okta

Admin → Applications → Create App Integration → SAML 2.0.
Single sign-on URL = ACS URL; Audience URI = Entity ID; Name ID format = EmailAddress; Application username = Email.
Optionally add a groups attribute statement and map those names in Traceline.
Sign On tab → View SAML setup instructions → copy the IdP SSO URL + X.509 certificate into Traceline.
Provisioning: enable SCIM — base URL + HTTP Header bearer auth; enable Create/Update/Deactivate Users.

Google Workspace

Admin console → Apps → Web and mobile apps → Add custom SAML app.
Download metadata (or copy SSO URL + certificate) → paste into Traceline.
ACS URL + Entity ID from Traceline; Name ID = Primary email, format EMAIL.
Google offers no SCIM for custom apps — rely on JIT plus manual deactivation, or a directory bridge.

OneLogin

Administration → Applications → Add App → SAML Custom Connector (Advanced).
Audience = Entity ID; Recipient, ACS URL Validator and ACS URL = ACS URL.
SSO tab → copy the SAML 2.0 Endpoint + X.509 certificate into Traceline.
Provisioning: OneLogin's SCIM connector (base URL + bearer).

Keycloak (self-hosted)

Realm → Clients → Import client → paste Traceline's SP metadata URL.
Client settings: Sign assertions ON, Name ID format email, Valid redirect URIs = ACS URL.
Client scopes → add a groups SAML attribute mapper (Group list, full path OFF).
Realm Settings → Keys → copy the RS256 certificate into Traceline; IdP sign-in URL = https://<kc>/realms/<realm>/protocol/saml.

Verifying without waiting for your IdP admin

GET the SP metadata URL — it must return XML mentioning AssertionConsumerService. On the sign-in page, type an allowed-domain email: the SSO button appears. Every SSO and SCIM event — started, failed with its reason, signed in, JIT-provisioned, role-synced, deactivated — is in Insights → Activity Log.