Guides

Manage SAML SSO

Understand the settings that HowlOps stores after the initial SAML setup.

On this page

Prerequisites
Service provider values
Identity provider values
Verify domain ownership
Test and enforce
Troubleshooting
See also

For a provider walkthrough from an empty workspace, use Configure SAML SSO. This page is the shorter reference for changing an existing connection.

Prerequisites

You must hold the Owner or Admin role.
The workspace must hold at least one non-free capability. See pricing.
Your identity provider (IdP) must support SAML 2.0.
Users signing in via SSO must have email addresses in the allowed domain.

Service provider values

Open Settings → SSO, choose SAML 2.0, and copy the values generated by HowlOps:

Value	Where to find it
ACS URL	The reply URL at your IdP
SP Entity ID	The audience or entity ID at your IdP
SP metadata	Metadata URL when your IdP can import it

Identity provider values

After creating the application at your IdP, download or copy:

A reachable IdP metadata URL, or
The complete IdP metadata XML.

Back in Settings → SSO:

Paste the metadata URL or XML.
Enter the SSO email domain, for example example.com.
Optionally map email, display name, and IdP group values to owner or member.
Select Save configuration.

New SSO users are provisioned just-in-time on their first successful sign-in: accounts are created automatically and an audit-log entry is written.

Verify domain ownership

Before SSO login will work, you must prove your organization controls the email domain you entered. This prevents another organization from claiming your domain.

Save the email domain so HowlOps can generate its verification record.
Publish the exact TXT host and value shown in Settings → SSO.
Select Verify domain after the record resolves publicly.

Until the domain is verified, SSO login is rejected and Enforce SSO cannot be turned on. A domain can only be claimed by one organization: if you see "already claimed by another organization", the domain is verified elsewhere; contact support if that is unexpected.

Test and enforce

Select Test SSO login before enforcing it. Keep the current admin session open while you finish the test.

Do not close your existing admin session until you have confirmed SSO is working. If something goes wrong, you can still log in with your password to fix the configuration.

After the domain is verified, Require SSO for this email domain disables password login for every account on that domain. The current login handler does not grant an password bypass for owners. Confirm that every required user can reach the IdP before you enable enforcement.

Troubleshooting

See SAML debugging guide for detailed error diagnostics.