Enterprise SSO & SCIM
Connect SAML or OIDC identity providers and provision users with SCIM 2.0, per company.
Where to configure
Profile menu → SSO & SCIM (/security/sso). Requires settings.sso.read / settings.sso.update (Owner and Administrator by default).
SSO (SAML 2.0 or OIDC)
- Choose OIDC or SAML.
- Enter verified email domains (e.g.
acme.com). Login looks up the domain and redirects to your IdP. - OIDC: paste the issuer (Entra / Okta / Google) and Discover from issuer, then client ID + secret.
- SAML: import IdP metadata URL or XML, or enter entity ID, SSO URL and certificate manually.
- Test connection, then Enable SSO.
Optional:
- Just-in-time user creation — first successful SSO login creates the user with the default role (or mapped roles).
- Enforce SSO — password login is blocked for those domains. Mark one owner membership as break-glass; that account must use password + authenticator (TOTP).
Group → role mapping
On the Group mappings tab, map IdP group names to Uktupus roles. The same mappings are used for SSO claims and SCIM Groups.
SCIM 2.0
- Open the SCIM tab and Generate token (shown once).
- In your IdP, set the SCIM base URL shown on the page (
…/api/v1/scim/v2) and the bearer token. - Users and Groups sync automatically. Deactivating a user ends their sessions immediately; membership history is kept.
Audit
The Audit tab lists SSO logins, failures, config changes and SCIM events. The same actions also appear under Activity.
How it fits the membership model
Users remain global; access is still one membership per company, with permissions resolved on every request (not baked into the JWT). SSO/SCIM only create or update memberships and roles.