Set up SSO step by step

This page walks through connecting your identity provider (IdP) using the portal’s setup wizard. For domain verification and enforcement (the wizard’s last two steps) see Email domains & enforcement; for automated user sync see SCIM provisioning.

Before you start

• Your account is on the Enterprise plan.
• You’re signed in as an account owner.
• You have admin access to your IdP (Okta, Microsoft Entra ID, Google Workspace, Auth0, etc.).

The wizard saves each step as you go, so you can close it and resume later without losing progress.

Step 1: Open the wizard

1. Go to portal.glueprint.ai.
2. Open Settings > Single Sign-On.
3. Click Set up SSO.

Step 2: Choose a protocol

Pick how your IdP speaks:

• OpenID Connect (OIDC) — the modern default. Recommended unless your IdP only offers SAML.
• SAML 2.0 — choose this if your IdP requires it.

Click Continue. The next step shows the fields for the protocol you chose.

Step 3: Configure your identity provider

This step has two halves: paste values from your IdP into Glueprint, then copy a value from Glueprint back into your IdP. Glueprint shows the exact values to copy in a Copy these into your IdP panel — always copy from there rather than typing a URL by hand, because they’re generated for your specific tenant.

If you chose OIDC

Fill in:

Field	What to enter
Issuer URL	Your IdP’s issuer (iss) value, e.g. https://your-tenant.okta.com. Must match exactly.
Discovery URL	The OpenID configuration endpoint, e.g. https://your-tenant.okta.com/.well-known/openid-configuration. Leave blank to auto-derive it from the issuer.
Client ID	The OAuth client ID from the app you created in your IdP.
Client Secret	The client secret from that app. (When editing later, leave blank to keep the existing secret.)

Under Advanced (optional):

• Allowed Microsoft tenant IDs — a comma-separated list of Entra tenant (tid) GUIDs. Restricts logins to those Entra tenants; leave blank to accept any.
• Required Google Workspace domain — enforces the Google hd claim, e.g. acme.com. Leave blank to accept any.

Then copy the Redirect URI shown in the panel and register it as the sign-in redirect (callback) URL in your IdP app.

If you chose SAML

Fill in:

Field	What to enter
IdP Entity ID	The identity provider’s entity ID / issuer, from your IdP app.
IdP SSO URL	The IdP’s single sign-on (HTTP-POST) endpoint.
IdP signing certificate (PEM)	The IdP’s X.509 signing certificate, pasted as PEM (-----BEGIN CERTIFICATE----- ...).
NameID format	emailAddress, persistent, or unspecified. Transient is not accepted — Glueprint links accounts on a stable NameID.
Allow IdP-initiated login	Off by default. Turn on to let users start sign-in from your IdP’s dashboard tile (see note below).

Glueprint requires signed assertions and supports encrypted assertions. If you turn on assertion encryption at your IdP, import Glueprint’s SP metadata so the IdP encrypts to the correct certificate.

IdP-initiated login (optional). By default Glueprint is SP-initiated: users start at the Glueprint login page (or your /sso/{slug} deep link) and Glueprint redirects them to your IdP. If your team prefers to launch Glueprint from the IdP’s dashboard (the app “tile”), turn on Allow IdP-initiated login. With it off, an assertion that arrives without a Glueprint-issued request is rejected with a “Missing RelayState” error. It’s a per-tenant setting you can change any time from Settings > Single Sign-On (the IdP-initiated login card). It’s slightly less strict than SP-initiated login (there’s no request/response binding), so enable it only if you need the dashboard-tile flow. To wire it up, point your IdP app’s SSO/ACS target at the ACS URL shown in the panel — no RelayState configuration is required, and if your IdP injects a static “Default RelayState”, leave it as-is (Glueprint treats an unrecognized RelayState as IdP-initiated when the setting is on).

Then copy the SP Entity ID and ACS URL shown in the panel into your IdP’s service-provider / SAML application settings. (If your IdP imports by metadata URL instead, the SP metadata URL is listed under Service-provider details on the main SSO page once your config is saved.)

Glueprint’s service-provider URLs live on the API host api.glueprint.ai. The wizard always shows the exact, tenant-specific values — copy those.

Click Save & continue.

Provider tips

These are starting points; follow your IdP’s own documentation for the exact screens.

• Okta — create an OIDC Web Application (for OIDC) or a SAML 2.0 app integration (for SAML). Paste Glueprint’s redirect URI / ACS URL into the app’s sign-in redirect or Single sign-on URL field.
• Microsoft Entra ID — register an application (OIDC) or create an Enterprise application (SAML). To restrict sign-in to your organization only, put your directory (tenant) GUID in Allowed Microsoft tenant IDs.
• Google Workspace — create an OAuth client (OIDC) or a custom SAML app. Set Required Google Workspace domain to your primary domain so only your users can sign in.

Step 4: Test the connection

When you reach the Test connection step the wizard probes your IdP automatically. For OIDC it checks that:

• the discovery URL is reachable,
• the IdP’s signing keys (JWKS) return at least one key, and
• the issuer matches what you entered.

A green result means you’re ready to enable. If a check fails, the error names the problem — fix the matching field in Step 3 and click Re-run test.

Step 5: Enable SSO

The first time you enable SSO, Glueprint asks you to re-enter your password. This unwraps your organization’s encryption key once so it can be re-secured for the passwordless SSO sign-in path. Your password is never sent to the relay.

Enter your password and click Continue. SSO is now active.

The wizard continues to two more steps — claiming an email domain and choosing an enforcement policy. Those are covered in Email domains & enforcement.

Troubleshooting

Symptom	Likely cause	Fix
Test fails: discovery unreachable	Wrong discovery URL, or network/firewall block	Recheck the Discovery URL; confirm it loads in a browser.
Test fails: issuer mismatch	Issuer URL doesn’t match the IdP’s iss value	Copy the issuer exactly as your IdP reports it (no trailing slash differences).
Test fails: no signing key	JWKS endpoint returns no keys	Confirm the IdP app is enabled and publishing signing keys.
Saved but secret looks empty	Client Secret is write-only; a saved secret shows as ••••••• (set)	This is expected. Leave it blank to keep the existing secret.
Members can’t find SSO at login	No verified email domain and no shared deep link	Claim a domain or share your /sso/{slug} link — see Email domains & enforcement.
SAML login fails with “Missing RelayState”	The user started from the IdP dashboard tile, but IdP-initiated login isn’t enabled	Sign in from the Glueprint login page or your /sso/{slug} link, or turn on Allow IdP-initiated login (SAML only).

Related topics

• SSO overview
• Email domains & enforcement
• SCIM provisioning