Single Sign-On (SSO)

SSO provides convenient and secure access to ScopeStack through your chosen identity provider (IdP).

All accounts can use regular credentialed access. By configuring SSO with your identity provider you also get:

• Single-click login from either our login page (Service Provider-initiated, SP) or from your app launcher (Identity Provider-initiated, IdP). A user signing in for the very first time must come from your app launcher — see How users get accounts.
• Centralized access control: removing a user in your identity system also removes their access to ScopeStack.

You can start with credentialed access and switch to SSO at any time. ScopeStack matches existing user emails against the addresses provided by your identity provider.

ScopeStack uses SAML 2.0 and supports Microsoft Entra ID, Okta, Salesforce, and any SAML 2.0 identity provider.

Setup process

SAML SSO is a short back-and-forth with our Support team. The order matters, so here is the full sequence:

1. We send you ScopeStack’s service provider (SP) details. You’ll receive two values to enter in your identity provider:

   • Identifier (Entity ID): https://app.scopestack.io/users/auth/<your-sso-name>/metadata
   • Reply / Assertion Consumer Service (ACS) URL: https://app.scopestack.io/users/auth/<your-sso-name>/callback

   We provide your <your-sso-name> value. You can also load our metadata directly from the Entity ID URL above.

2. You configure your identity provider. Create a SAML enterprise application using the Identifier and Reply URL above, assign the users who should have access, and download your signing certificate. See the provider-specific guides below.

3. You send the information back to Support at support@scopestack.io (details in the next section).

4. We configure SSO and enable a single test user. Configuration changes are applied on our side and are not instant, so we’ll let you know when it’s ready to test. Then test twice:

   • An existing user signs in at app.scopestack.io  (SP-initiated), then again from your app launcher (IdP-initiated). Both should reach your identity provider.
   • Someone with no ScopeStack account opens the app from your launcher. Their account should be created automatically on that first sign-in. Starting at our login page will not work for them yet, which is expected — see How users get accounts.

5. We enable SSO for your whole account.

Once those steps are complete, you’re good to go.

How users get accounts

With SSO enabled, you do not pre-create users. An account is created the first time someone signs in through your identity provider, and they receive the account’s default role.

The first sign-in has to start at your identity provider. That means the app tile in your launcher (My Apps in Microsoft Entra ID) or the application’s user access URL. Once the account exists, that person can sign in either way from then on.

Someone who does not have a ScopeStack account yet cannot start at app.scopestack.io . When an email address is entered there, ScopeStack looks it up to decide where to send that person; an address it does not recognize gets the standard password form rather than a redirect to your identity provider. That is expected, and it is the usual reason a new user appears not to be provisioned.

You do not need to configure provisioning in your identity provider. Accounts are created from the sign-in itself. ScopeStack does not use SCIM, so the Provisioning section of a Microsoft Entra enterprise application can be left alone. If your enterprise application requires assignment, assigning the user to the application is all that is needed.

Information we need

Send the following to support@scopestack.io:

Signing certificate (required). Paste the certificate as plain text — the full block beginning with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE----- — or attach it as a .cer or .pem file. Please don’t send a link to a file-sharing service (SharePoint, OneDrive, Google Drive); attach the file or paste the text so we can use it directly.

Login (SSO) URL and Logout (SLO) URL (required). These are the sign-on and logout URLs from your identity provider.

⚠️ Microsoft Entra ID: use the SAML 2.0 endpoint for both, not the WS-Federation endpoint. Both URLs should look like https://login.microsoftonline.com/<tenant-id>/saml2. Do not send the .../wsfed endpoint — ScopeStack uses SAML 2.0, and the WS-Federation endpoint causes login to fail with the error AADSTS20012.

Fingerprint / Thumbprint (not needed). You do not need to send the certificate fingerprint (called Thumbprint in Microsoft Entra ID). The full certificate is all we need, and configuring with the certificate alone is the most reliable setup. A fingerprint is optional and can cause signature-validation failures if its hash algorithm doesn’t match your provider’s, so we recommend leaving it out.

Federation metadata XML (optional but helpful). If your identity provider can export a metadata XML file, include it — it contains the certificate and URLs in one place.

Provider-specific guides

For help finding these items, see the documentation for common identity providers:

Microsoft Entra ID

• Enable single sign-on for an enterprise application in Microsoft Entra ID 
• Advanced certificate signing options in a SAML token 
• Manage certificates for federated single sign-on 

Salesforce

• Enable Salesforce as a SAML Identity Provider 

Okta

• Add a SAML pass-through application to Okta