Single sign-on (SSO) allows your team to securely access Tines 3B using your organization's existing identity provider (IdP). This streamlines the login process by eliminating the need for separate credentials.
What you’ll need before you start:
Admin access: You must have administrative permissions to configure SSO settings.
Protocol: You will need your identity provider’s connection details for either OIDC or SAML.
Open your SSO settings to get started, like this:
Step 1: Choose your authentication protocol
Select the tab corresponding to your preferred authentication protocol:
OIDC or SAML.
Step 2: Configure provider details
For OIDC (OpenID Connect)
Issuer URL: Enter your IdP’s OIDC discovery URL (e.g., https://your-org.okta.com). This must be a public HTTPS URL.
Domain: (Optional) Restrict sign-ins to a specific email domain. Leave blank to allow any domain.
Client ID: Enter the OAuth client ID from your IdP’s application settings.
Client secret: Enter the OAuth client secret provided by your IdP.
Scopes: (Optional) Defaults to openid, profile, and email. Enter custom scopes as comma- or space-separated values.
For SAML:
Domain: (Optional) Restrict sign-ins to a specific email domain.
Import IdP metadata: Choose one of the following methods:
Metadata URL: Provide the URL to your IdP’s SAML metadata.
Metadata XML: Paste the XML metadata directly into the field.
Manual Entry: Enter the Issuer (Entity ID), Entry Point URL, and Signing Certificate individually.
Step 3: Configure user provisioning (optional)
You can automate how user accounts are created and managed:
Off: No automated provisioning. Users must be manually managed.
JIT (Just-in-Time): Accounts are automatically created the first time a user signs in via SSO.
SCIM: Enables automated user and group provisioning via the SCIM 2.0 protocol. If you choose this, you will be provided with a SCIM token after saving; use this token to configure your IdP for automatic syncing.
If you are using SCIM, learn how to set it up here.
Step 4: Configure attribute mapping (SAML only)
If you are using JIT provisioning, ensure that your IdP maps the following SAML assertion attributes to your user profile fields:
Email (Required)
First name (Required)
Last name (Required)
Image (Optional)
Step 5: Finalize and test
Configure IdP callback URLs: Copy the callback URLs displayed in the SSO settings form and paste them into your IdP’s application configuration.
OIDC: Use the Redirect URI provided.
SAML: Use the provided ACS URL, Entity ID, and metadata URL.
Save: Click "Add provider" to finish the setup.
Verify: We recommend signing in with a separate browser/incognito window to test redirection to IdP works correctly, to avoid lockout issues if SSO has been misconfigured.
Managing existing providers
Once configured, you can manage your settings at any time:
Update: Modify settings as needed. Leaving fields blank will retain existing values.
Revoke sessions: Force all currently signed-in users to re-authenticate.
Delete: Remove the SSO configuration.
Note: The delete action cannot be undone and will revert your team to standard login methods.
How to manually invite a user to the tenant
If you are not using automatic provisioning, you can manually invite users to join your account from the members tab in settings.
Click the "+" button in the top-right corner. Enter the users details and send the invite.
Important notes for manual invites
Duplicate prevention: If you invite a user whose email already exists in your system but is currently deactivated, the system will reactivate the account rather than creating a duplicate.
Disabled invites: The option to manually invite users is disabled if your SSO provider is configured for JIT or SCIM provisioning.