Single Sign-On (SSO)

Single Sign-On lets your team sign in to Aptlystar through your company's identity provider instead of managing separate passwords. Aptlystar supports both OIDC and SAML 2.0.

Setup

1. Open SSO settings

Go to Settings → Enterprise → Single Sign-On in your workspace.

2. Choose a protocol

Protocol	Use when
OIDC	Your IdP supports OpenID Connect — Okta, Microsoft Entra ID, Auth0, Google Workspace
SAML 2.0	Your IdP is SAML-only — ADFS, Shibboleth, or older enterprise IdPs

3. Fill in the form

Fields required for both protocols:

Field	What to enter
Provider ID	A short slug identifying this connection, e.g. `okta` or `azure-ad`. Letters, numbers, and dashes only.
Issuer URL	The identity provider's issuer URL. Must be HTTPS.
Domain	Your organization's email domain, e.g. `company.com`. Users with this domain will be routed through SSO at sign-in.

OIDC additional fields:

Field	What to enter
Client ID	The application client ID from your IdP.
Client Secret	The client secret from your IdP.
Scopes	Comma-separated OIDC scopes. Default: `openid,profile,email`.

For OIDC, Aptlystar automatically fetches endpoints (authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri) from your issuer's /.well-known/openid-configuration discovery document. You only need to provide the issuer URL.

SAML additional fields:

Field	What to enter
Entry Point URL	The IdP's SSO service URL where Aptlystar sends authentication requests.
Identity Provider Certificate	The Base-64 encoded X.509 certificate from your IdP for verifying assertions.

4. Copy the Callback URL

The Callback URL shown in the form is the endpoint your identity provider must redirect users back to after authentication. Copy it and register it in your IdP before saving.

OIDC providers (Okta, Microsoft Entra ID, Google Workspace, Auth0):

https://aptlystar.ai/api/auth/sso/callback/{provider-id}

SAML providers (ADFS, Shibboleth):

https://aptlystar.ai/api/auth/sso/saml2/callback/{provider-id}

5. Save and test

Click Save. To test, sign out and use the Sign in with SSO button on the login page. Enter an email address at your configured domain — Aptlystar will redirect you to your identity provider.

Provider Guides

Okta (OIDC)

In Okta (official docs):

Go to Applications → Create App Integration
Select OIDC - OpenID Connect, then Web Application
Set the Sign-in redirect URI to your Aptlystar callback URL:
```
https://aptlystar.ai/api/auth/sso/callback/okta
```
Under Assignments, grant access to the relevant users or groups
Copy the Client ID and Client Secret from the app's General tab
Your Okta domain is the hostname of your admin console, e.g. dev-1234567.okta.com

In Aptlystar:

Field	Value
Provider Type	OIDC
Provider ID	`okta`
Issuer URL	`https://dev-1234567.okta.com/oauth2/default`
Domain	`company.com`
Client ID	From Okta app
Client Secret	From Okta app

The issuer URL uses Okta's default authorization server, which is pre-configured on every Okta org. If you created a custom authorization server, replace default with your server name.

Microsoft Entra ID (OIDC)

In Azure (official docs):

Go to Microsoft Entra ID → App registrations → New registration
Under Redirect URI, select Web and enter your Aptlystar callback URL:
```
https://aptlystar.ai/api/auth/sso/callback/azure-ad
```
After registration, go to Certificates & secrets → New client secret and copy the value immediately — it won't be shown again
Go to Overview and copy the Application (client) ID and Directory (tenant) ID

In Aptlystar:

Field	Value
Provider Type	OIDC
Provider ID	`azure-ad`
Issuer URL	`https://login.microsoftonline.com/{tenant-id}/v2.0`
Domain	`company.com`
Client ID	Application (client) ID
Client Secret	Secret value

Google Workspace (OIDC)

In Google Cloud Console (official docs):

Go to APIs & Services → Credentials → Create Credentials → OAuth 2.0 Client ID
Set the application type to Web application

Add your Aptlystar callback URL to Authorized redirect URIs:

https://aptlystar.ai/api/auth/sso/callback/google-workspace

Copy the Client ID and Client Secret

In Aptlystar:

Field	Value
Provider Type	OIDC
Provider ID	`google-workspace`
Issuer URL	`https://accounts.google.com`
Domain	`company.com`
Client ID	From Google Cloud Console
Client Secret	From Google Cloud Console

To restrict sign-in to your Google Workspace domain, configure the OAuth consent screen and ensure your app is set to Internal (Workspace users only) under User type. Setting the app to Internal limits access to users within your Google Workspace organization.

ADFS (SAML 2.0)

In ADFS (official docs):

Open AD FS Management → Relying Party Trusts → Add Relying Party Trust
Choose Claims aware, then Enter data about the relying party manually
Set the Relying party identifier (Entity ID) to your Aptlystar base URL:
```
https://aptlystar.ai
```
Add an endpoint: SAML Assertion Consumer Service (HTTP POST) with the URL:
```
https://aptlystar.ai/api/auth/sso/saml2/callback/adfs
```
Export the Token-signing certificate from Certificates: right-click → View Certificate → Details → Copy to File, choose Base-64 encoded X.509 (.CER). The .cer file is PEM-encoded — rename it to .pem before pasting its contents into Aptlystar.
Note the ADFS Federation Service endpoint URL (e.g. https://adfs.company.com/adfs/ls)

In Aptlystar:

Field	Value
Provider Type	SAML
Provider ID	`adfs`
Issuer URL	`https://aptlystar.ai`
Domain	`company.com`
Entry Point URL	`https://adfs.company.com/adfs/ls`
Certificate	Contents of the `.pem` file

For ADFS, the Issuer URL field is the SP entity ID — the identifier ADFS uses to identify Aptlystar as a relying party. It must match the Relying party identifier you registered in ADFS.

Once SSO is configured, users with your domain (company.com) can sign in through your identity provider:

User goes to aptlystar.ai and clicks Sign in with SSO
They enter their work email (e.g. alice@company.com)
Aptlystar redirects them to your identity provider
After authenticating, they are returned to Aptlystar and added to your organization automatically
They land in the workspace

Users who sign in via SSO for the first time are automatically provisioned and added to your organization — no manual invite required.

SSO provisioning creates internal organization members. External workspace members are different: they are invited to a specific workspace without joining your organization or consuming one of your seats.

Password-based login remains available. Forcing all organization members to use SSO exclusively is not yet supported.

Common Questions

Any identity provider that supports OIDC or SAML 2.0. This includes Okta, Microsoft Entra ID (Azure AD), Google Workspace, Auth0, OneLogin, JumpCloud, Ping Identity, ADFS, Shibboleth, and more.

The domain (e.g. company.com) is how Aptlystar routes users to the right identity provider. When a user enters their email on the SSO sign-in page, Aptlystar matches their email domain to a registered SSO provider and redirects them there.

No. For OIDC providers, Aptlystar automatically fetches the authorization, token, and JWKS endpoints from the discovery document at {issuer}/.well-known/openid-configuration. You only need to provide the issuer URL.

Aptlystar creates an account for them automatically and adds them to your organization. No manual invite is needed. They are assigned the member role by default. External workspace members are not provisioned through SSO into your organization; they are invited directly to a workspace and remain outside your org roster.

Yes. Enabling SSO does not disable password-based login. Users can still sign in with their email and password if they have one. Forced SSO (requiring all users on the domain to use SSO) is not yet supported.

Organization owners and admins can configure SSO. You must be on the Enterprise plan.

The Callback URL (also called Redirect URI or ACS URL) is the endpoint in Aptlystar that receives the authentication response from your identity provider. For OIDC providers it follows the format: https://aptlystar.ai/api/auth/sso/callback/{provider-id}. For SAML providers it is: https://aptlystar.ai/api/auth/sso/saml2/callback/{provider-id}. You must register this URL in your identity provider before SSO will work.

Open Settings → Enterprise → Single Sign-On and click Edit. Update the fields and save. The existing provider configuration is replaced.

Single Sign-On (SSO)

Common Questions

On this page