ProvenMap
Reference & Resources

Enterprise SSO

Single sign-on lets your team sign in through Okta, Microsoft Entra ID, Google Workspace, OneLogin, or any provider that supports SAML 2.0 or OpenID Connect (OIDC). Members use work credentials, and access stays managed in your IdP.

Setup usually takes about 15 minutes:

  1. Create an application in your identity provider
  2. Connect it in Settings → SSO configuration
  3. Verify your email domain with a DNS record
  4. Test the login. Then, when you are ready, require SSO for everyone
Note

Enterprise SSO is an organization admin task, and it is available on the Team plan (5 or more contributors) and on Enterprise. If you do not see the SSO configuration panel, check your plan or ask your workspace owner. If your plan changes to one without SSO, your configuration is preserved and resumes automatically when you upgrade again.

Before you start

The SSO configuration panel shows the Service Provider (SP) values for your IdP: ACS URL, audience URI, and redirect URI. Copy them from the panel, not this page.

Step 1 — Create the app in your IdP

The setup pattern is the same for every provider: create an app, set the SP values, and send email, given_name, and family_name.

SAML is recommended for Okta.

  1. In the Okta Admin console, go to Applications → Applications → Create App Integration and choose SAML 2.0.

  2. Give it a name (e.g. "ProvenMap") and continue to Configure SAML:

    • Single sign-on URL — the ACS URL from the SSO configuration panel (an https://…/saml2/idpresponse address).
    • Audience URI (SP Entity ID) — the Audience URI from the panel (a urn:amazon:cognito:sp:… value).
    • Name ID format — EmailAddress.
    • Application username — Email.

  3. Add three Attribute Statements (format Basic):

    NameValue
    emailuser.email
    given_nameuser.firstName
    family_nameuser.lastName

  4. Finish the wizard, then open the app's Sign On tab and copy the Metadata URL.

  5. On the Assignments tab, assign the people or groups who should be able to sign in.

Tip

Assign yourself to the app first. Confirm that you can sign in before you turn on enforcement in Step 4.

Step 2 — Connect it in the portal

Open Settings → SSO configuration and fill in:

  1. Choose SAML 2.0 or OpenID Connect to match the app you created.
  2. Pick an SSO login slug. Your members will sign in at portal.provenmap.com/login/sso/<slug>, so choose something short and recognizable. Your company name usually works.
  3. Provide the IdP details:
    • SAML — paste the metadata URL, or switch to XML and paste the metadata document directly.
    • OIDC — enter the issuer URL, client ID, and client secret.
  4. Click Test Connection to confirm we can reach your IdP, then Save SSO Configuration.
Important

Your OIDC client secret is sent directly to the identity broker and stored only there. It is not stored in our database, and it is not shown again. When you edit the connection later, leave the secret field blank to keep the existing one, or enter a new value to replace it.

Step 3 — Verify your email domain

Verifying a domain lets members reach your IdP with only their work email. It is also required before SSO enforcement.

  1. In the Verified Email Domains panel, add your domain (e.g. acme.com).
  2. We show you a TXT record to create. In your DNS provider, add it at the domain root: Host @, Value the provenmap-verify=… string we generated.
  3. Once DNS has propagated (usually a few minutes), come back and click Verify.
Note

A domain can be verified by only one organization. If verification fails, double-check the record is on the root (@) and that the value matches exactly, then give DNS a little longer to propagate.

Step 4 — Test, then require SSO

Enforcement requires a working test login.

  1. Open your SSO login URL, ideally in a private window so your admin session stays signed in, and sign in through your IdP. You should arrive in the portal. First-time SSO users join your organization automatically as contributors, up to your seat limit.
  2. Back on the settings page, click Confirm test login.
  3. When both checklist items are green, at least one verified domain and one successful test login, you can turn on Require SSO. From then on, members on your verified domains can no longer sign in with a password or Google; they are sent to your IdP instead.
Warning

The organization owner is always exempt from Require SSO. This prevents a full lockout: even if your IdP is unavailable or misconfigured, the owner can still sign in with a password and fix the connection. Everyone else on a verified domain must use SSO.

How your team signs in

Once live, there are three sign-in paths:

Where they startWhat happens
Type a work email on the login pageWe recognize the verified domain as they type and show a Continue with SSO button under the field. No slug is needed.
Click Single sign-on on the login pageOpens a page that asks only for a work email, then sends them to your IdP. Use this when people already know they want SSO.
Open portal.provenmap.com/login/sso/<slug>Skips the email step. The slug identifies the organization, so the redirect starts as the page loads.

The first two options require a verified domain. The slug URL does not, so use it while DNS propagates.

Tip

Add the slug URL to your onboarding docs or your IdP's app tile. It keeps working even before a domain is verified.

Note

If someone's domain is not verified or your organization has not finished setting up SSO, the email-based paths say that single sign-on is not configured for the address. They then return the person to password sign-in. We do not reveal whether the domain belongs to an organization, so nobody can use the login page to identify companies with accounts.

How it behaves day to day

Just-in-time membership

The first SSO sign-in creates the account and adds the person as a contributor. An admin can raise their role later in Settings → Team.

Provisioning respects your seat limit. If no seats are free, sign-in is refused until you free or add a seat.

Linking existing accounts

Existing password accounts are linked by verified email on first SSO sign-in. The account and boards stay the same.

Removing access

Removing a user in your IdP stops new SSO sign-ins. To end active access immediately, also suspend the member in Settings → Team. SCIM is on the roadmap.

Single logout

Signing out here does not sign you out of your IdP. SAML Single Logout (SLO) is not supported today.

Verify your setup

Verify once live:

  • The IdP app is assigned to your test user (done)
  • Test Connection succeeds in the SSO configuration panel
  • You can sign in at portal.provenmap.com/login/sso/<slug>
  • A first-time SSO user arrives in the portal as a contributor
  • Your domain shows Verified after the TXT record is added
  • Typing a work email on the login page offers Continue with SSO
  • Single sign-on on the login page takes you to the work-email page, and a verified-domain address reaches your IdP
  • An address on an unverified domain gets the "not configured" message instead
  • With Require SSO on, a password login for a verified-domain user is refused
  • The organization owner can still sign in with a password

What's next

Permissions & Access

Control who can view and edit boards once your team is signed in.

Organization Settings

Configure roles, archetypes, and the rest of your organization.