Single Sign-On

​

Where it lives

Single Sign-On sits under Settings, at Internal SSO.

​

Before you start

​

How it works

Introw supports single sign-on in two protocols, SAML 2.0 and OIDC, in two places. Internal SSO controls how your own team signs in to Introw, and portal SSO controls how partners sign in to the portal. Both follow the same core pattern: you pick the protocol, give your identity provider the service provider details Introw shows, enter your provider’s connection details back in Introw, and enable it. With SAML you paste your provider’s metadata URL; with OIDC you enter a discovery URL and client credentials. Internal SSO also maps identity attributes and a default role so team members arrive with the right identity and access; portal SSO maps only the email claim, since partners are matched by email. The internal SSO page additionally hosts SCIM provisioning, where your identity provider creates and deactivates team members on its own. Once enabled, sign-in goes through your identity provider. Enabling portal SSO makes your identity provider the portal’s sign-in method, so partners use it instead of email or social login. Internal SSO’s service provider URLs are built on Introw’s domain, while portal SSO’s are built on your portal address (your custom domain if you have one, otherwise your subdomain).

​

Settings & configuration

SSO is configured under Settings, Developers, on two pages: Internal SSO and Portal SSO. Each page works the same way: pick a protocol, exchange configuration with your identity provider, then enable it.

​

Protocol

At the top of each page, SAML 2.0 and OIDC are the two protocols to choose between. Pick whichever your identity provider uses; the rest of the page changes to match.

​

Service provider configuration

The Service Provider Configuration block shows the values to enter into your identity provider. For SAML 2.0 these are the Assertion Consumer Service (ACS) URL, the Entity ID, and the Metadata URL. For OIDC it is a single Redirect URI. Each value has a copy button. On internal SSO these URLs are built on Introw’s domain; on portal SSO they are built on your portal address (your custom domain if you have one, otherwise your subdomain).

​

Identity provider configuration

The Identity Provider Configuration block is where you enter your provider’s details. For SAML 2.0, paste your provider’s Metadata URL; Introw fetches and validates it. For OIDC, enter the Discovery URL (your provider’s .well-known configuration address), the Client ID, and the Client secret (a Saved or Not set pill shows whether a secret is stored), then pick the Scopes to request (commonly openid, profile, and email). Introw validates the discovery URL as you enter it.

​

Attribute mapping

On internal SSO, the Attribute mapping block maps the claims your provider sends to Introw’s user fields: User ID, Email address, First name, and Last name, plus a Default role new users receive the first time they sign in. Portal SSO maps only the Email address claim, since partner contacts are matched by email, so it has no user-field or role mapping.

​

Allowed domains (internal SSO only)

The Allowed domains block lists the email domains whose users may sign in through SSO and be created on first login. Your own primary domain is always allowed; add others with Add.

​

Test login

Before enabling, use Test SSO Login and select Test login: it opens your identity provider in a popup, confirms the connection, and shows which attributes it returns, without creating or signing in a user. Save your configuration first.

​

SCIM provisioning (internal SSO only)

The internal SSO page also hosts a SCIM provisioning section, where your identity provider creates, updates, and deactivates team members automatically. It runs independently of whether you switch your team to SSO sign-in. For the full setup, see Provision your team with SCIM.

​

Portal SSO and portal access

Enabling portal SSO makes your identity provider the portal’s sign-in method, which replaces the other portal sign-in methods (email and social) for partners.

​

How-to guides

​

Troubleshooting