Skip to Content
HelpAdministrationSingle Sign-On (SSO)

Single Sign-On (SSO)

SSO provides convenient and secure access to ScopeStack through your chosen identity provider (IdP).

All accounts can use regular credentialed access. By configuring SSO with your identity provider you also get:

  • Single-click login from either our login page (Service Provider-initiated, SP) or from your app launcher (Identity Provider-initiated, IdP).
  • Centralized access control: removing a user in your identity system also removes their access to ScopeStack.

You can start with credentialed access and switch to SSO at any time. ScopeStack matches existing user emails against the addresses provided by your identity provider.

ScopeStack uses SAML 2.0 and supports Microsoft Entra ID, Okta, Salesforce, and any SAML 2.0 identity provider.

Setup process

SAML SSO is a short back-and-forth with our Support team. The order matters, so here is the full sequence:

  1. We send you ScopeStack’s service provider (SP) details. You’ll receive two values to enter in your identity provider:

    • Identifier (Entity ID): https://app.scopestack.io/users/auth/<your-sso-name>/metadata
    • Reply / Assertion Consumer Service (ACS) URL: https://app.scopestack.io/users/auth/<your-sso-name>/callback

    We provide your <your-sso-name> value. You can also load our metadata directly from the Entity ID URL above.

  2. You configure your identity provider. Create a SAML enterprise application using the Identifier and Reply URL above, assign the users who should have access, and download your signing certificate. See the provider-specific guides below.

  3. You send the information back to Support at support@scopestack.io (details in the next section).

  4. We configure SSO and enable a single test user. That user signs in at app.scopestack.io  (SP-initiated), then from your app launcher (IdP-initiated). Configuration changes are applied on our side and are not instant, so we’ll let you know when it’s ready to test.

  5. We enable SSO for your whole account.

Once those steps are complete, you’re good to go.

Information we need

Send the following to support@scopestack.io:

Signing certificate (required). Paste the certificate as plain text — the full block beginning with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE----- — or attach it as a .cer or .pem file. Please don’t send a link to a file-sharing service (SharePoint, OneDrive, Google Drive); attach the file or paste the text so we can use it directly.

Login (SSO) URL and Logout (SLO) URL (required). These are the sign-on and logout URLs from your identity provider.

⚠️ Microsoft Entra ID: use the SAML 2.0 endpoint for both, not the WS-Federation endpoint. Both URLs should look like https://login.microsoftonline.com/<tenant-id>/saml2. Do not send the .../wsfed endpoint — ScopeStack uses SAML 2.0, and the WS-Federation endpoint causes login to fail with the error AADSTS20012.

Fingerprint / Thumbprint (not needed). You do not need to send the certificate fingerprint (called Thumbprint in Microsoft Entra ID). The full certificate is all we need, and configuring with the certificate alone is the most reliable setup. A fingerprint is optional and can cause signature-validation failures if its hash algorithm doesn’t match your provider’s, so we recommend leaving it out.

Federation metadata XML (optional but helpful). If your identity provider can export a metadata XML file, include it — it contains the certificate and URLs in one place.

Provider-specific guides

For help finding these items, see the documentation for common identity providers:

Microsoft Entra ID

Salesforce

Okta

Last updated on