DOCS

Configure SSO (SAML)

Set up SAML single sign-on for your workspace to enable centralized identity management.

Premium

Enterprise

SAML SSO is available on Premium and Enterprise tiers.

Prerequisites

You must hold the Owner or Admin role.
Your identity provider (IdP) must support SAML 2.0 (Okta, Microsoft Entra ID / Azure AD, Google Workspace, and others).
Users signing in via SSO must have email addresses in the allowed domain.

Steps

1. Open SSO settings in HOWLOPS

Go to Settings > Security > Single sign-on.
Click Configure SSO.

Copy the following values — you will need them at your IdP:

Value	Where to find it
ACS URL	Shown in the SSO settings panel
Entity ID (SP)	Shown in the SSO settings panel

2. Create the application at your IdP

Create a new SAML application in your IdP and use the values above. Exact steps vary by provider:

Okta: Applications > Create App Integration > SAML 2.0 > paste ACS URL and Entity ID.
Entra ID / Azure AD: Enterprise applications > New application > Create your own > Non-gallery > set up SAML.
Google Workspace: Admin console > Apps > Web and mobile apps > Add app > Add custom SAML app.

Set the Name ID format to EmailAddress and map the user's email address as the Name ID value.

3. Configure the IdP details in HOWLOPS

After creating the application at your IdP, download or copy:

The IdP Metadata XML (preferred), or
The IdP SSO URL and X.509 certificate separately.

Back in HOWLOPS Settings > Security > SSO:

Paste the metadata XML or fill in the individual fields.
Enter the allowed email domains (comma-separated), for example example.com.
Optionally enable Just-in-time (JIT) provisioning to automatically create accounts for new SSO users.
Click Save.

4. Test the configuration

Open a private/incognito browser window.
Go to your HOWLOPS login page and click Sign in with SSO.
Enter your email address and follow the IdP authentication flow.
You should be redirected back to HOWLOPS and logged in.

Do not close your existing admin session until you have confirmed SSO is working. If something goes wrong, you can still log in with your password to fix the configuration.

5. Optional: enforce SSO

To require all workspace members to use SSO (preventing password login):

Go to Settings > Security > SSO.
Enable Enforce SSO for all members.

Owners retain an emergency password bypass for breakglass access.

Troubleshooting

See SAML debugging guide for detailed error diagnostics.