/
Single Sign On (SSO) & Provisioning

Single Sign On (SSO) & Provisioning

Single Sign-On

1. Overview

1.1 General

  1. Web App only. Doesn’t work for instances created from Monday and Salesforce.

  2. SAML 2.0 protocol.

  3. Up to 10 connections simultaneously.

  4. SSO endpoint has to be unique across all Oboard organisations.

  5. JIT provisioning supports user email and name.

  6. Domains whitelist is required.

  7. Domain can be linked to only one org at a time.

1.2 Limitations

  1. User can't switch organisation from SSO organisation.

  2. User can't switch to SSO organisation from any other, except Owner role.

  3. User can't Create a new organisation from SSO organisation.

  4. User can't log in to another organisation except SSO with email with domain linked to SSO organisation.

1.3 Supported identity providers

Azure Entra, Okta, Google Workspace, Ping Identity, Auth0, and any SAML 2.0 compliant identity provider.

1.4 Billing

Works only with Enterprise subscription plan.

2. Configuration

2.1 Create connection in Oboard

  1. Go to Oboard web app https://app.oboard.io/

  2. Open Settings > Integrations > SSO.

  3. Create connection.

  4. Select SAML connection, provider and enter connection name.

  5. Move to next step.

  6. Enter a list of allowed domains.

  7. Copy ACS URL, SP ENTITY ID.

  8. Go to identity provider.

2.2 SAML setup for Microsoft Entra ID

  1. Сreate an enterprise app:

    1. Go to Azure Portal https://portal.azure.com/.

    2. Open the portal menu and select Enterprise applications.

    3. Click New application.

    4. Click Create your own application.

    5. Provide a name for your app, Oboard is recommended.

    6. Select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

  2. Basic SAML configuration:

    1. In the Overview page, select Set up single sign-on.

    2. Select SAML.

    3. Click Edit.

    4. Set Identifier (Entity ID) = SP ENTITY ID from Oboard.

    5. Set Reply URL (Assertion Consumer Service URL) = ACS URL from Oboard.

    6. Click save.

      image-20250902-213004.png

     

  3. Set attribute statements for JIT provisioning (optional):

    1. Select Attributes & Claims.

    2. Click Unique User Identifier (Name ID).

    3. Make sure that Name identifier format = Email address, otherwise SSO won’t work correctly.

      image-20250902-195623.png

       

    4. Select http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name in a list of attributes.

    5. Remove namespace.

    6. Select Source = Transformation.

    7. Transformation = Join(), attribute1 = user.givenname, separator = “ “, attribute2 = user.surname.

    8. Click add.

      image-20250902-195256.png

       

    9. Click save.

  4. Get Entra credentials and set in Oboard:

    1. Copy Login URL (Entra) = SSO Endpoint (Oboard).

    2. Download Certificate (Base64), open in text editor and copy (Entra) = Certificate (Oboard)

    3. Copy Microsoft Entra Identifier (Entra) = Issuer (Oboard).

    4. Go to Oboard.

  5. Add users or groups to the app:

    1. Go to app in Entra.

    2. Select users and groups.

    3. Add user/group.

    4. Add list of users/groups that you want to provide access via SSO.

2.3 SAML setup for Okta

  1. Сreate SAML app:

    1. Log in to your Okta Application Dashboard and click Applications in the sidebar.

    2. Click Create App Integration.

    3. Click Create New App and choose SAML 2.0 as the Sign-in method. Then, click Next.

    4. Provide a name for your app, Oboard is recommended.

    5. Set Single sign-on URL = ACS URL.

    6. Set Audience URI (SP Entity ID) = SP ENTITY ID.

    7. Set Name ID format = Email. Make sure that you set up email, otherwise SSO won’t work correctly.

      image-20250902-213158.png

       

  2. Fill attribute statements (optional):

    1. Go Attribute Statements configuration in SAML Settings, fill in the following Attribute Statements and click Next.

    2. Add name property = user.firstName+user.lastName.

    3. Complete connection setup.

      image-20250902-213232.png

       

  3. Get OKTA credentials:

    1. Copy Sign on URL.

    2. Download Signing Certificate.

    3. Go to Oboard.

  4. Add users or groups to the app:

    1. Go to app in Okta.

    2. Select Assignments.

    3. Assign user/group.

    4. Add list of users/groups that you want to provide access via SSO.

2.4 SAML setup for others

  1. Make sure that you select SAML protocol.

  2. Use ACS URL, SP ENTITY ID to establish connection.

  3. Make sure that identifier is email.

  4. Set saml.name = user.firstname + user.lastname in IdP to have JIT (optional).

2.5 Complete connection in Oboard

  1. SSO Endpoint = Login URL.

  2. Certificate = Certificate (Base64).

  3. If it is first SSO connection, all users will be logged out.

3. Domains

  • User can log in to organisation only with domains that listed in SSO configuration and validated.

  • To let users in, at least one domain is required.

  • You can add many domains to a one connection and organisation.

3.1 Verify domain

  1. Domain verification processes on Oboard side. Send email to mailto:support@oboard.io with such a request.

image-20260601-131151.png

4. Authentication

All users logged in first time gets User role and to no workspace or group.

4.1 Log in from Microsoft self-service page

  1. Open https://myapps.microsoft.com/

  2. Find and click on Oboard app (name of the app depends on organisation setup).

  3. System redirects user to Oboard page and authorised to respective organisation.

4.2 Log in from Okta self-service page

  1. Open self service page.

  2. Find and click on Oboard SSO app.

  3. System redirects user to Oboard page and authorised to respective organisation.

4.3 Log in from Oboard login page

  1. Open Oboard login page https://id.oboard.io/account/login

  2. Enter email linked to SSO organisation.

  3. If you have active IdP session you will be logged in, otherwise you need to login to IdP first.

Provisioning

1. Overview

1.1 General

  1. SCIM protocol.

  2. Up to 10 Provisioning connections simultaneously.

  3. Provisioning supports add, remove user and user name update.

2. Configuration

2.1 Create connection in Oboard

  1. Go to Oboard web app https://app.oboard.io/

  2. Open Settings > Integrations > SSO.

  3. Create connection.

  4. Select SCIM protocol.

  5. Setup SCIM connection name.

  6. Move to next step.

  7. Copy Provisioning URL, Authorization token.

  8. Go to identity provider.

2.2 SCIM set up in Microsoft Entra

  1. Configure an enterprise app:

    1. Go to Azure Portal https://portal.azure.com/.

    2. Select app, and go to Provisioning page.

    3. Click on Connect your application.

    4. Set organisation URL = Provisioning URL.

    5. Set Secret token = Authorization token.

    6. Click Test connection and then Create.

      image-20250903-112635.png

 

  1. Disable Group provisioning:

    1. Enterprise applications → <app_name> → Provisioning → Attributes mapping.

image-20260105-125532.png

  1. Enable provisioning:

    1. Click Start provisioning to enable auto provisioning job.

    2. You can also user provisioning on demand to instantly addd users by SCIM.

      image-20250903-112907.png

3. Add/remove user

  1. After SCIM enabling, IdP will automatically add and remove users in Oboard.

  2. The main identifier is user email.

  3. All users added by SCIM gets User role and don’t assign to workspace or group.