🔐

OIDC & SAML

Available

Enterprise single sign-on with OpenID Connect and SAML 2.0. Integrate with your identity provider for secure, centralized authentication.

What you can do

Single Sign-On with your IdP

Support for OIDC and SAML 2.0

Automatic user provisioning (SCIM)

Group-based role mapping

Just-in-time user creation

Multi-provider support

Decide whether to use OIDC (recommended for most providers) or SAML 2.0 (for legacy enterprise systems).

Add tapioca as an application in your IdP (Okta, Azure AD, Google Workspace, etc.). Use the callback URLs from tapioca settings.

OIDC Callback: https://your-domain.tapioca.app/auth/callback
SAML ACS: https://your-domain.tapioca.app/auth/saml/acs

Go to Settings → Authentication → SSO and enter your IdP configuration (client ID, secret, or SAML metadata).

Map IdP groups or roles to tapioca roles for automatic permission assignment.

Test the SSO flow with a test user before enabling for your organization.

Option	Type	Required	Description
provider_type	enum	Yes	OIDC or SAML
client_id	string	Yes	OAuth Client ID (OIDC only)
client_secret	string	Yes	OAuth Client Secret (OIDC only)
issuer_url	string	No	OIDC Issuer URL for auto-discovery
saml_metadata_url	string	No	SAML IdP metadata URL (SAML only)
role_attribute	string	No	Attribute containing user roles Default: `groups`
role_mapping	object	No	Map IdP roles to tapioca roles
auto_create_users	boolean	No	Create users on first login Default: `true`

SSO login fails with redirect error

Verify the callback/ACS URL is correctly configured in your IdP. Check for trailing slashes.

Users not getting correct roles

Check your role_attribute configuration and ensure the IdP is sending group claims. Verify role_mapping is correct.

SAML signature validation failed

Ensure you are using the correct IdP certificate. Certificates expire and may need updating.

Our team is here to help you get set up and running.