SSO Authentication
SSO Authentication
Configure SAML, OIDC, and social sign-in (Google, Microsoft, GitHub) for your Safeguard tenant.
SSO Authentication
Safeguard supports five identity provider (IdP) types for tenant sign-in: SAML 2.0, OpenID Connect (OIDC), and OAuth "social" login via Google, Microsoft, and GitHub. This page walks through configuring each, provider by provider.
Which approach should I use?
| Approach | Best when | Supports |
|---|---|---|
| SAML 2.0 | You need IdP-side group/attribute-based control, or your IdP doesn't offer a simple OAuth app | Okta, Microsoft Entra ID, Google Workspace, OneLogin, Ping Identity, Duo Security, JumpCloud, Auth0, Keycloak, Authentik, AD FS, Shibboleth, SailPoint IdentityNow, CyberArk Identity, IBM Security Verify |
| OAuth "social" login | Fastest to set up; you don't need SAML-specific attribute mapping | Google, Microsoft, GitHub |
| OpenID Connect (OIDC) | You want OIDC specifically instead of SAML from a provider that supports both, or any other OIDC 1.0-compliant provider | Auth0, Keycloak, self-hosted or other OIDC IdPs |
How sign-in works
Once a provider is configured, users can sign in two ways — both land them in Safeguard:
- SP-initiated (recommended) — the user starts at
https://app.safeguard.sh, enters their email, and is sent to the IdP to authenticate. This is the primary, always-available path and works for every provider type (SAML, OIDC, social). - IdP-initiated — the user launches Safeguard from the IdP itself: an app-launcher tile/dashboard, or a "Test SAML login" button. For SAML providers, Safeguard detects the unsolicited response arriving at its broker endpoint and transparently restarts it as an SP-initiated login, so — since the user is already authenticated at the IdP — it completes without a second prompt. (OIDC and social logins are inherently SP-initiated.)
Either way, on first login Safeguard applies your tenant's provisioning policy to decide whether to create the account.
Where to configure SSO
- Sign in as a tenant Admin or Owner.
- Go to Settings → Authentication.
- Scroll to the Single Sign-On section.
From here you can:
- Add Provider — opens the Add Identity Provider dialog covered in the sections below.
- Test — verifies Safeguard can complete a round-trip with the provider.
- Delete — removes a provider (existing sessions created via that provider are not revoked automatically; users must sign in again on their next session).
The right-hand Policy panel controls what happens on first SSO login and whether password login stays available — see Provisioning policy.
In this section
- URLs & Endpoints — the callback, ACS, and metadata URLs your IdP needs.
- SAML 2.0 — generic steps plus fifteen provider-specific guides.
- OpenID Connect (OIDC) — connect any OIDC 1.0-compliant provider.
- Social Login — Google, Microsoft, and GitHub OAuth buttons.
- Provisioning Policy — what happens on first SSO login.
- Testing & Troubleshooting — verify a provider and debug common errors.