Skip to content

SSO overview

What single sign-on does in Glueprint, who it's for, and the pieces that make it up -- protocols, domain claims, enforcement, and SCIM.

Available on
  • Web Portal

Single sign-on (SSO) lets your team sign in to Glueprint with your existing identity provider (IdP) — Okta, Microsoft Entra ID, Google Workspace, Auth0, or any standards-compliant provider — instead of a Glueprint password. You can also turn on automated user provisioning with SCIM so accounts are created, updated, and deactivated in lockstep with your directory.

Everything below is configured in the web portal at portal.glueprint.ai under Settings > Single Sign-On.

Requirements

  • Enterprise plan. SSO and SCIM are Enterprise features. On any lower tier the SSO settings page shows an upgrade prompt instead of the setup wizard. See Plans.
  • Account owner. Only an account owner can configure SSO. Admins and members see the page in read-only form.

Protocols

Glueprint speaks both major SSO protocols. You pick one during setup.

  • OpenID Connect (OIDC) — the modern default. Works with Okta, Auth0, Google Workspace, and Microsoft Entra ID. Recommended for new setups.
  • SAML 2.0 — choose this only if your IdP requires it. Glueprint requires signed assertions and supports encrypted assertions.

How it fits together

A complete SSO rollout has a few moving parts. Each links to its own step-by-step page:

  • IdP connection — the credentials and URLs that let Glueprint and your IdP trust each other. See Set up SSO step by step.
  • Email-domain claims — verify a domain you own (for example acme.com) so anyone with a matching email is automatically routed to your IdP from the login page. See Email domains & enforcement.
  • Enforcement — decide whether SSO is optional or required. Account owners always keep a password break-glass so an IdP outage can’t lock you out. See Email domains & enforcement.
  • SCIM provisioning — let your IdP create, update, and deactivate users (and map directory groups to Glueprint roles) automatically. See SCIM provisioning.

How sign-in works for your team

Once SSO is enabled, members sign in one of two ways:

  • By email — if you’ve verified the email domain, a member enters their work email on the login page and Glueprint forwards them to your IdP.
  • By deep link — if you haven’t claimed a domain, members visit your tenant’s sign-in link, https://portal.glueprint.ai/sso/{your-slug}, which sends them straight to your IdP.

After authenticating at the IdP, the member lands back in Glueprint. First-time users are provisioned automatically (just-in-time), or ahead of time if you use SCIM.

Roles assigned by SSO

When a user signs in (or is provisioned via SCIM), Glueprint assigns a role:

  • A default role you choose — member, admin, or billing.
  • Optionally, a group-to-role mapping so a directory group lands its members on a specific role.

The owner role can never be granted through SSO or SCIM — it’s reserved for the human who set up the account.

PreviousCLI daemon
NextSet up SSO step by step