Set up SSO and SCIM

Overview

Register an IdP such as Microsoft Entra ID, Okta, Google Workspace or HENNGE One, and members can sign in with their company accounts. SAML 2.0 and OpenID Connect are supported. Owners and admins of projects on the Enterprise plan can set this up.

Steps

1. 1

   Open "SSO" in the console and choose the protocol (SAML 2.0 or OpenID Connect).

2. 2

   Register the values shown on the screen in your IdP, then enter the IdP's values and your company's email domain in Scandock and register.

3. 3

   Click "Show TXT record", add the value as a TXT record in your email domain's DNS, and click "Verify". Until the domain is verified, this IdP cannot be used to sign in.

4. 4

   On the sign-in page, choose "Sign in with your company account (SSO)" and enter your work email address.

SAML 2.0

• Values to register in the IdP: The reply URL (ACS URL) and identifier (Entity ID), both shown on Scandock's SSO screen.
• What the IdP must send: The email address, either as the NameID (format emailAddress) or as an attribute named email. Assertions must be signed.
• Values to enter in Scandock: The IdP identifier (Issuer or Entity ID), the IdP sign-in URL (SSO URL) and the IdP signing certificate (PEM). Names differ between IdPs.

OpenID Connect

• Value to register in the IdP: The redirect URI, shown on Scandock's SSO screen.
• Values to enter in Scandock: The IdP identifier (Issuer), client ID and client secret. Scandock reads the remaining settings from the issuer's /.well-known/openid-configuration.

Domain verification

The TXT record name is _scandock-verify-<ID>.<domain>, and its value is shown on the SSO screen. The value is valid for 7 days, and DNS changes can take a few minutes to a few hours.

Members

When someone with an email address in the domain signs in with their company account for the first time, they join the project as a Member. You can change their role on the Members page. People who already have an account are linked to the account with the same email address.

Password sign-in keeps working after SSO is set up. If the Enterprise subscription ends, SSO sign-in stops.

Automatic member provisioning (SCIM)

IdPs that support SCIM 2.0 (Microsoft Entra ID, Okta and others) can add and remove members automatically. It is available to projects on the Enterprise plan that have verified their domain.

1. 1

   On the SSO page in the console, open "Automatic member provisioning (SCIM)" and click "Generate token". The token is shown only at this point.

2. 2

   In the provisioning settings of your IdP's app, enter the endpoint URL (tenant URL) shown on the page and the token.

3. 3

   When you assign users or groups to the app in your IdP, those people join the project.

How SCIM handles members

• Add: Assigned people join with the Member role. People who already have a Scandock account are linked to that account. Only people with email addresses in the verified domains are provisioned.
• Update: Names and email addresses follow the IdP. Roles are not changed from the IdP; change them on the Members page.
• Remove: When you unassign a user or deactivate them in your IdP, they are removed from this project and can no longer reach its data. Their account remains and other projects are not affected. Assign them again to bring them back as a member.