SSO & Provisioning
Single sign-on routing and enforcement (SAML 2.0 and OIDC) and SCIM 2.0 provisioning are Scale and Enterprise features. Configure them from Settings → Workspace security (/settings/workspace-security).
The console host is console.owlpane.com and the API host is api.owlpane.com; the Identity Provider (IdP) endpoints below are served from the API host.
SAML 2.0
Owlpane acts as a SAML Service Provider (SP). Configure your IdP with the SP metadata and wire the endpoints below.
| Purpose | Endpoint |
|---|---|
| SP metadata | GET /v1/auth/saml/metadata |
| Start sign-in | GET /v1/auth/saml/start |
| Assertion Consumer Service (ACS) | POST /v1/auth/saml/acs |
Configure the SP with these settings:
| Setting | Value |
|---|---|
OWLPANE_SAML_ENTRY_POINT | Your IdP's sign-in URL. |
OWLPANE_SAML_IDP_CERT | The certificate used to validate IdP responses. |
OWLPANE_SAML_SP_ENTITY_ID | The entity id Owlpane presents to the IdP. |
OWLPANE_SAML_LABEL | The label shown on the sign-in button. Defaults to SAML SSO. |
OIDC
OWLPane supports OpenID Connect for IdPs that prefer it.
| Purpose | Endpoint |
|---|---|
| Discovery config | GET /v1/auth/oidc/config |
| Start sign-in | GET /v1/auth/oidc/start |
| Callback | GET /v1/auth/oidc/callback |
Configure the client with these settings:
| Setting | Value |
|---|---|
OWLPANE_OIDC_ISSUER | The issuer URL of your IdP. |
OWLPANE_OIDC_CLIENT_ID | The client id Owlpane uses. |
OWLPANE_OIDC_CLIENT_SECRET | The client secret Owlpane uses. |
OWLPANE_OIDC_LABEL | The label shown on the sign-in button. Defaults to SSO. |
Register the callback endpoint (GET /v1/auth/oidc/callback) as the redirect URI in your IdP.
SCIM 2.0 provisioning
SCIM 2.0 keeps your workspace membership in step with your IdP directory. Per-organization tokens are stored server-side, so each organization provisions against its own credential.
| Purpose | Endpoint |
|---|---|
| List / create users | GET /v1/scim/v2/Users, POST /v1/scim/v2/Users |
| Update a user | PATCH /v1/scim/v2/Users/:id |
| List / create groups | GET /v1/scim/v2/Groups, POST /v1/scim/v2/Groups |
| Replace a group | PUT /v1/scim/v2/Groups/:id |
Point your IdP's SCIM client at these endpoints with the organization's SCIM token. Some legacy single-tenant deployments are configured instead with OWLPANE_SCIM_BEARER_TOKEN and OWLPANE_SCIM_ORG_ID.
Enforcing SSO
SSO routing lets members sign in through your IdP; enforcement requires it. Both are enabled from Settings → Workspace security. Because SSO and SCIM are Scale and Enterprise features, plan accordingly — see Plans & Billing.
Related environment variables
Identity settings are provided through environment variables, alongside the ingest and OTLP variables. See Environment variables for the reference listing.
Related
- Members & Roles — the roles SCIM assigns.
- Audit & Retention — audit-log export (Scale+).
- API Tokens — what SCIM does and does not cover.
Last updated