Skip to main content
Choose how your workspace users sign in. Enabling single sign-on (SSO) delegates authentication to a trusted identity provider (IdP), removing the need for separate Oleria passwords and giving your team a consistent login experience. From Settings → SSO Configuration, you can connect one or more SAML identity providers and enable Microsoft social sign-in. Google social sign-in is available by default. For the governance app, you can provision reviewers automatically the first time they sign in. Only Administrators can change SSO settings.

​
Main workspace and governance app

The SSO Configuration page has two tabs, each configuring sign-in for a different part of Oleria independently:
  • Main Workspace - how everyone with a workspace role signs in to your Oleria workspace.
  • Governance App - how reviewers sign in to the governance app to complete access reviews, request and approve access requests, and review workflows.
Each tab has its own list of SAML identity providers and its own social sign-in settings, so you can connect different providers to each. Automatic user provisioning is available on the Governance App tab only.
Both tabs show the same Oleria details (Entity ID, ACS URL, and Single logout URL) while you add an identity provider, because they share a single service provider. This is expected - copy the same details into whichever identity provider you connect to either tab.

​
Connect a SAML identity provider

Adding a SAML identity provider is a two-step exchange: you tell Oleria how to reach your IdP, then you copy Oleria’s service provider details back into that IdP.
1

Open the SSO configuration page

Go to Settings → SSO Configuration and select the Main Workspace or Governance App tab, depending on who should sign in through this provider.
2

Start adding an identity provider

In the SAML IdP card, click Add IdP.
3

Enter the SAML IdP details

Complete the SAML IdP details step:
  • Name - a label for the provider. Use 3-32 characters. The name must be unique across your entire workspace, including both tabs, cannot contain spaces, and cannot be google, microsoft, or cognito. You cannot change the name after you create the provider.
  • Sign requests - select to sign the SAML authentication requests Oleria sends to your identity provider.
  • Encrypt SAML responses - select to require your identity provider to encrypt its SAML responses.
  • Metadata - provide your IdP’s SAML metadata in exactly one of two ways: enter a metadata URL (must start with https://), or paste the metadata XML document. Provide one or the other, not both.
4

Copy the Oleria details into your identity provider

On the Oleria details step, copy the Entity ID, ACS URL, and Single logout URL into your identity provider’s SAML application configuration. These values identify Oleria as the service provider and tell your IdP where to send responses. If you selected Sign requests, also give your identity provider the Request signing certificate shown on this step, so it can verify the requests Oleria sends.
5

Save the identity provider

Click Add identity provider. Users can now sign in through this provider.
6

Confirm sign-in works

Sign out of Oleria, select the provider on the sign-in page, and confirm you land back in Oleria.
If Oleria cannot reach or parse the metadata at the URL you entered, the save fails. Confirm the URL is correct, publicly reachable, and served over HTTPS, then try again.

​
Edit or remove an identity provider

In the identity providers list, use the actions next to a provider:
  • Edit (pencil) - update the provider’s settings. Every field except Name can be changed.
  • Remove (trash) - delete the provider. Removal takes effect immediately. Users can no longer sign in through it, so make sure another sign-in method is available first.

​
Enable Microsoft social sign-in

You can let users sign in with a Microsoft account instead of, or in addition to, a SAML provider.
1

Open the tab you want to configure

Go to Settings → SSO Configuration and select the Main Workspace or Governance App tab.
2

Select Microsoft account

Select Enable Microsoft account.
3

Save your changes

Save the settings. Microsoft is now available on the sign-in page.

​
Automatically provision reviewers

On the Governance App tab, automatic user provisioning creates an Oleria account for people the first time they sign in through a SAML provider or a social connection. You do not have to add each reviewer by hand. Automatically provisioned users are added as reviewers.
Automatic user provisioning is available for the governance app only. It is not available on the Main Workspace tab.
You control who can be provisioned with two lists:
  • Allowed domains - up to 10 email domains (for example, acme.com). A domain must match exactly; acme.com does not include subdomains such as eu.acme.com. Only people whose email domain is on this list can be provisioned.
  • Blocked emails - up to 50 individual email addresses (for example, name@acme.com). People on this list are never provisioned, even if their domain is allowed.
1

Open the Governance App tab

Go to Settings → SSO Configuration and select the Governance App tab.
2

Enable automatic user provisioning

Select Enable automatic user provisioning.
3

Add at least one allowed domain

Under Allowed domains, add the email domains that should be provisioned automatically. Optionally, add addresses to Blocked emails to exclude specific people.
4

Save your preferences

Click Save preferences. The new settings apply to the next sign-in. They do not change accounts that already exist.
You must add at least one allowed domain before you can save with automatic user provisioning enabled. Saving with the toggle on and no allowed domains fails.
When automatic user provisioning is off, someone who signs in through SSO but does not already have an Oleria account is denied access. Either select Enable automatic user provisioning or add the person in Manage Users first.

​
Contact us

For questions, contact us at support@oleria.com.