Skip to main content

Single Sign-On (SSO)

Qarion supports enterprise Single Sign-On through OIDC and SAML 2.0 protocols. SSO allows your team to authenticate via your existing identity provider (IdP) such as Okta, Azure AD, or Google Workspace.

How It Works​

When SSO is enabled for an organization, users are redirected to your IdP for authentication. After successful authentication, they are automatically provisioned in Qarion (if needed) and signed in with appropriate organization membership.

Configuring SSO​

SSO is configured at the organization level. Contact your platform administrator to set up SSO with the following information:

OIDC Configuration​

SettingDescription
Provider NameHuman-readable name shown on the login page (e.g., "Sign in with Okta")
Client IDOAuth 2.0 Client ID from your IdP
Client SecretOAuth 2.0 Client Secret
Authorization URLIdP authorization endpoint
Token URLIdP token endpoint
Issuer URLOIDC issuer URL for token validation
Allowed DomainsEmail domains permitted to log in via SSO

SAML 2.0 Configuration​

SettingDescription
Provider NameHuman-readable name for the login button
IdP Entity IDYour IdP's entity identifier
IdP SSO URLSingle Sign-On service URL
IdP CertificateX.509 certificate for signature validation
Allowed DomainsEmail domains permitted to log in

For SAML setups, Qarion provides a Service Provider (SP) metadata endpoint at /sso/metadata/{org_slug} that you can import into your IdP.

SSO Login Flow​

  1. User visits the Qarion login page and clicks the SSO button
  2. Qarion redirects to your IdP's authorization URL
  3. User authenticates with the IdP
  4. IdP redirects back to Qarion with an authorization code (OIDC) or SAML assertion
  5. Qarion validates the response, provisions the user if needed, and issues a JWT

Cross-Instance SSO​

For organizations with multiple Qarion instances, Cross-Instance SSO enables a single IdP configuration to authenticate users across all instances. When a user authenticates:

  • The system resolves the correct target instance from the SSO configuration
  • The user is provisioned in the target instance (if not already a member)
  • The JWT includes instance context, ensuring the user is routed to the correct instance

This eliminates the need to configure SSO separately for each instance.

Enforcing SSO​

When SSO Required is enabled for an organization:

  • The standard email/password login is disabled
  • Users must authenticate through the configured IdP
  • The login page shows only the SSO button

Single Logout (SLO)​

Qarion supports IdP-initiated single logout. When a user clicks "Sign Out":

  1. Qarion clears the local session
  2. If the IdP supports SLO, the user is redirected to the IdP's logout endpoint
  3. The IdP terminates the SSO session across all connected applications

User Provisioning​

Users are automatically provisioned on their first SSO login:

  • Email — Extracted from the IdP's claims
  • Name — First and last name from IdP claims (if available)
  • Organization Membership — Automatically linked to the SSO-configured organization
  • Instance Membership — For cross-instance SSO, users are added to the target instance

Troubleshooting​

"SSO not configured" — Verify that SSO has been set up for your organization. The organization slug in the login URL must match the configured organization.

"Domain not allowed" — Your email domain is not in the allowed domains list for this SSO configuration.

Login page doesn't show SSO button — Ensure you are navigating to the organization-specific login URL.