SSO Setup

Single Sign-On lets your team log in to Sempleo using your organization's identity provider (IdP).

Supported Protocols

• SAML 2.0 — Works with Okta, Azure AD, OneLogin, Google Workspace, and any SAML 2.0-compliant IdP
• OIDC — OpenID Connect support for modern identity providers

Configuration Steps

1. Gather IdP Information

From your identity provider, you'll need:

• IdP SSO URL — The login endpoint
• IdP Entity ID — The unique identifier for your IdP
• IdP Certificate — The X.509 certificate for signature verification

2. Configure in Sempleo

1. Go to Settings → Security → SSO
2. Select your protocol (SAML or OIDC)
3. Enter the IdP details
4. Sempleo provides an SP Entity ID and ACS URL to configure in your IdP

3. Configure Your IdP

In your identity provider:

1. Create a new SAML/OIDC application
2. Set the ACS URL to the value provided by Sempleo
3. Set the Entity ID to the value provided by Sempleo
4. Map the required attributes:
   • email (required)
   • firstName (recommended)
   • lastName (recommended)

4. Test and Enable

1. Click Test Connection in Sempleo
2. Log in via your IdP to verify the flow works
3. Enable SSO for your workspace
4. Optionally, enforce SSO-only login (disables password login)

Provisioning

SSO supports Just-in-Time (JIT) provisioning:

• When a user logs in via SSO for the first time, their account is automatically created
• They are assigned the default role (Member) and can be assigned to teams by an admin
• SCIM provisioning for automatic user lifecycle management is on the roadmap

Troubleshooting