deplaneDocs Dashboard

Single sign-on

Let your staff sign in through your company's identity provider (IdP) over SAML: Okta, Microsoft Entra ID, Google Workspace, Keycloak, JumpCloud and others. It is on the Enterprise plan.

Single sign-on belongs to one team. Someone in your team and in a side project of their own uses your IdP only when they open your team.

How signing in works

  1. On the sign-in page, choose Sign in with SSO and enter the team's short name. Or use the app tile in your IdP.
  2. Deplane shows where you are going (your IdP's address). Press Continue.
  3. Sign in at your company.
  4. Confirm with your passkey or authenticator code, as usual. Your IdP replaces the email link, not the second factor.

Only people who are already in the team, and who have set up a passkey or authenticator app, can sign in this way. Invite them first, and have them set up their passkey from the invitation; no account is ever created from an IdP sign-in.

Set it up

Owners open Members in the dashboard and scroll to Single sign-on.

  1. In your IdP, create a SAML app. Enter Deplane's Entity ID and ACS URL from that section, or give it the metadata file.
  2. Set the app to sign the assertion with SHA-256. Signing only the response is refused. Do not encrypt the assertion.
  3. Send the user's email: as the NameID in email format, or as an attribute (email, mail and Microsoft's email claim are recognised; name another one in Deplane if yours differs).
  4. Set the app tile's address to Deplane's Start URL, so that a sign-in always starts at Deplane. Sign-ins your IdP starts on its own are refused.
  5. Download the IdP's metadata XML, paste it into Deplane or choose the file, and press Save. Deplane never fetches anything from your IdP.
  6. Press Test sign-in and sign in with your own account.

Okta

Applications → Create App Integration → SAML 2.0. Single sign-on URL is the ACS URL; Audience URI is the Entity ID; Name ID format EmailAddress; Application username Email. Under advanced settings, Assertion Signature: Signed. The metadata is under Sign On → SAML Signing Certificates → View IdP metadata.

Microsoft Entra ID

Enterprise applications → New application → Create your own → Set up single sign on → SAML. Identifier is the Entity ID; Reply URL is the ACS URL; Sign on URL is the Start URL. Signing Option: Sign SAML assertion. Download Federation Metadata XML.

Google Workspace

Admin console → Apps → Web and mobile apps → Add custom SAML app. ACS URL and Entity ID from Deplane, Name ID format EMAIL, Name ID Basic Information → Primary email. Download the IdP metadata.

Keycloak

Clients → Create client → SAML. Client ID is the Entity ID; Valid redirect URIs is the ACS URL. Turn Sign assertions on and Encrypt assertions off; Name ID format email. The metadata is at Realm settings → SAML 2.0 Identity Provider Metadata.

Making it required

After a successful test, an owner can press Make required. From then on:

Owners can still open the team with a passkey if the IdP is down (not approve new CLI logins). Each time, it appears in Activity and the other owners get an email.

Required turns off by itself, and owners get an email, if the IdP settings change or the team leaves the Enterprise plan (the first time anyone uses the team after the change). Run a test and turn it on again.

An IdP sign-in lasts for your Deplane session, at most 12 hours. New IdP settings need a new sign-in.

Linked accounts

The first time someone signs in through the IdP, Deplane remembers the IdP's ID for them. A different IdP account with the same email is refused. An owner can clear a person's link under Single sign-on.

What it does not do

Errors are listed in Errors.

This page is also available as Markdown. AI agents can start at /llms.txt.