Single sign-on (SAML / OIDC)
Send everyone on your email domain through Okta, Entra ID, Google Workspace or any SAML or OIDC identity provider.
Workspace owners and admins set up single sign-on under Settings → Members → Single sign-on. Once the email domain is verified, anyone who signs in with an address on that domain is sent to your identity provider and joins the workspace as a member on first sign-in. One provider per email domain.
Set up SAML from the metadata URL
The quickest and safest way is the identity provider's metadata URL for the JobsPipe application. It carries the entity ID, the sign-on URL and the signing certificate of that application, so there is nothing to copy by hand.
- Click Add identity provider, keep SAML selected, and enter your email domain (for example
acme.com). - Paste the metadata URL and click Fetch. The entity ID, sign-on URL and certificate fill in. Check them, then Save provider.
- In your identity provider, enter the two values the card shows for the application:
- ACS URL (also called reply URL or single sign-on URL)
- SP entity ID (also called audience URI or identifier)
- Verify the domain: click Get the TXT record, add it at your DNS host, then Check DNS and verify. Nobody can sign in through the provider until the domain is verified.
- Click Test sign-in. You are sent through your identity provider and back to the card with the result.
Where the metadata URL is:
- Microsoft Entra ID: Enterprise applications → your JobsPipe application → Single sign-on → section 3, SAML Certificates → App Federation Metadata Url. Use the application's URL (it ends in
?appid=...), not the tenant-wide federation metadata. - Okta: Applications → your application → Sign On → Metadata URL (or the Identity Provider metadata link).
- Google Workspace: Google does not publish a URL. Copy the certificate from the SAML app and paste it as described below.
Set up SAML by hand
If you cannot use a metadata URL, fill in the three values yourself:
- IdP entity ID (issuer): the identity provider's identifier, for example
https://sts.windows.net/<tenant-id>/orhttp://www.okta.com/exk.... - IdP single sign-on URL: where we send people to sign in.
- IdP signing certificate: the X.509 certificate the identity provider signs responses with, as PEM or bare base64.
Paste the certificate of the JobsPipe application, not your tenant's. In Entra ID that is Single sign-on → SAML Certificates → Certificate (Base64) on the enterprise application. A tenant-wide certificate looks valid but every sign-in fails with a certificate mismatch.
Set up OIDC
Choose OIDC, enter your email domain, the issuer URL (for example https://acme.okta.com), and the client ID and secret of an application whose redirect URI is the Redirect URI the card shows.
Replace a certificate
Identity providers rotate signing certificates, and a wrong one can be saved by mistake. On the provider's row, click Replace certificate, then either fetch the metadata URL again or paste the new certificate and click Check certificate to see its thumbprint before saving. Domain verification is kept. Run Test sign-in afterwards.
The card shows the thumbprint and expiry of the saved certificate, and warns when it expires within 30 days.
When a sign-in fails
The card shows the last failed sign-in through the provider, in plain words plus the code:
| Code | What it means | What to do |
|---|---|---|
saml_certificate_mismatch | The identity provider signs with a certificate that is not the one saved. | Replace certificate. |
saml_issuer_mismatch | The identity provider's entity ID differs from the issuer saved. | Replace certificate, then fetch the metadata URL. |
saml_expired | The identity provider's answer arrived too late, or its clock is off. | Try again; check the clock on the identity provider. |
saml_denied | The identity provider declined, usually because the user is not assigned to the application. | Assign the user in the identity provider. |
invalid_saml_response, replay_detected, unsolicited_response | The identity provider answered a sign-in we had not started, or answered it twice. | Ask the user to sign in again. |
The row clears on the next successful sign-in through the provider.
The person signing in sees a plain explanation on the sign-in page and is told to contact a workspace admin.
Remove a provider
Remove on the provider's row stops sign-ins through it immediately. People who already joined keep their accounts and can use another sign-in method. Adding the domain again means verifying it with a new DNS record.