Single sign-on and SCIM

This page is for the workspace Owner who sets up company sign-in. It covers verified domains, SAML 2.0 and OpenID Connect (OIDC) providers, how members sign in with SSO, the workspace sign-in policy, and SCIM provisioning.

Before you startCopy Anchor Link

• The workspace is on the Enterprise plan. Other plans get plan_feature_unavailable unless Veriom has turned the feature on for your workspace.
• You are an Owner. Admins can view these settings, but only Owners can change them.
• You can create an app in your identity provider, for example Okta or Microsoft Entra ID.

Open Settings and select Single sign-on. Every change asks you to confirm your identity.

Verify your email domainsCopy Anchor Link

Veriom signs people in with SSO, and provisions them over SCIM, only when their email is in a domain your workspace has verified. A verified domain belongs to one Veriom workspace.

1. Under Domains, enter the part after the @ in your work email, for example example.com, and click Add domain.
2. At your DNS provider, add the TXT record Veriom shows. Copy its TXT record name (_veriom-verification.example.com) and TXT record value (veriom-domain-verification=…).
3. Click Verify domain. DNS changes can take a few minutes to appear. If Veriom does not find the record yet, it shows the TXT values it found instead.

Verify each domain your people sign in with, such as a subsidiary's domain. Keep the TXT record in place.

Add a SAML 2.0 providerCopy Anchor Link

1. Under Identity providers, click Add provider and choose SAML 2.0.
2. Copy Veriom's service provider values into a new SAML app in your identity provider:
   • SP entity ID
   • ACS URL (HTTP-POST binding)
   • SP metadata URL, if your provider can import metadata
3. Give Veriom your provider's details in one of three ways: its Metadata URL, its Metadata XML, or Enter values (IdP entity ID, Single sign-on URL, and Signing certificate).
4. In Allowed domains, list the email domains this provider may sign in, for example example.com.
5. Save. The provider starts in a testing state.
6. Click Test sign-in and finish the sign-in at your identity provider. A successful test activates the provider.

Add an OIDC providerCopy Anchor Link

1. Create an OIDC web app in your identity provider.
2. In Veriom, click Add provider and choose OpenID Connect (OIDC).
3. Enter the Provider name, Issuer URL, Client ID, Client secret, and Allowed domains.
4. Save. The provider shows its Redirect URI. Copy it and register this exact URL as the redirect (callback) URI of the app in your identity provider.
5. Click Test sign-in to activate the provider.

Each provider in the list shows the URL to register with a copy button: the Redirect URI for an OIDC provider, and the ACS URL for a SAML provider.

How members sign in with SSOCopy Anchor Link

On the Veriom sign-in page, members click Sign in with SSO and enter their work email. Veriom finds the workspace that verified the email's domain and sends them to its identity provider. If the domain has more than one active provider, they choose one.

Members can also start from your identity provider's app dashboard. Veriom does not sign anyone in from a sign-in it did not start. It sends a new sign-in request to the same identity provider, which answers at once because the member is already signed in there. This blocks replayed and forged sign-ins, and the dashboard tile still works.

Set the sign-in policyCopy Anchor Link

Under Sign-in policy:

You can only turn SSO on after a provider is active, which means its test sign-in passed, and your workspace has a verified domain.

Enforce SSOCopy Anchor Link

When SSO posture is Enforced, a member who signed in with a password or GitHub sees Sign in with SSO when they open the workspace, with a button for each active provider. After the identity provider signs them in, they return to the page they opened.

Owners keep a break-glass path in case your identity provider is down. While Owner recovery is on, an Owner who signed in, or confirmed their identity, with two-factor authentication or a passkey keeps access. Each use is recorded in the activity log as identity.sso.break_glass_used.

To keep you from locking yourself out, Veriom refuses to enforce SSO until a domain is verified. If you enforce it from a session that did not come from SSO, keep Owner recovery on and sign in with two-factor authentication or a passkey first. You cannot remove the last verified domain while SSO is enforced.

Provision members with SCIMCopy Anchor Link

1. Under SCIM provisioning, click Create a SCIM token.
2. Copy the token. Veriom shows it once. Tokens start with scim_, and a workspace can have up to 3 active tokens.
3. In your identity provider's provisioning settings, enter the SCIM base URL that Veriom shows and the token.
4. Map your groups to Veriom roles. A group can map to Viewer, Developer, Analyst, or Admin. Users provisioned without a group mapping become Viewer. No group can grant Owner.

To replace a token, click Rotate token. To stop provisioning, click Revoke token.

If something goes wrongCopy Anchor Link