Single sign-on integrations

Single sign-on allows you to enable users to log into Uniform using your preferred authentication service, such as Microsoft Entra ID (formerly Azure Active Directory), Okta, or any other provider that supports SAML 2.0.

Setting up SSO#

1. Connection name#

The connection name is a unique identifier that you and Uniform agree on. Alphanumeric with dashes - 'mycompany', 'mycompany-uniform', or similar.

2. Configure your IdP#

Uniform is the service provider. Your provider needs these values, where [CONNECTION NAME] is the identifier agreed above.

Value	Setting
Identifier (Entity ID)	`urn:auth0:uniformsystems:[CONNECTION NAME]`
Reply URL (Assertion Consumer Service URL)	`https://login.uniform.app/login/callback?connection=[CONNECTION NAME]`
Uniform's Single Logout (SLO) URL	`https://login.uniform.app/logout`

On EU data residency, substitute login.eu.uniform.app for login.uniform.app in both URLs. Uniform will tell you which applies to your account.

Note: Uniform does not support IdP-initiated SSO. We do support SP-initiated sign-in using https://uniform.app/?login_hint=<email-address> to initiate login. For EU, substitute eu.uniform.app.

Attribute mapping#

Uniform takes the user's identifier from the SAML NameID, and expects email and name as attributes. The default mapping reads user_id from the first of its three claim type URIs the assertion carries:

{ "user_id": [ "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" ], "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" }

If your provider asserts these under different claim type URIs, send Uniform the ones it uses and we will map them.

3. Provide Uniform with required information#

Setting up SSO requires you provide Uniform with the following information. For all but the last two items, we can also extract it from SAML metadata:

Value	Description
Sign in URL	Where Uniform should send SSO sign in requests to (your IdP)
Your IdP's Single Logout (SLO) URL	Where Uniform sends sign out requests - optional
X.509 token-signing certificate	The certificate carrying the public key that verifies your IdP's assertion signature, encoded in `.pem` or `.cer` format.
Email domains for home realm discovery	Uniform dispatches to your IdP based on the domain of the user signing in to Uniform. We need to know which domain(s) will be owned by your IdP - users in these domains will have to sign in using your SSO. e.g. "mycompany.com, mycompany.de"
Use a SAML group attribute or SCIM to provision authorization?	Uniform can automatically authorize your users based on group membership. Uniform supports inbound SCIM 2.0 to sync users, profiles, and groups. If you do not want to use SCIM, you can also assert a group attribute. Group mapping is optional; you can choose to use SSO only for authentication and configure authorization in Uniform.

4. Configure SCIM#

If you are using SCIM, Uniform will provide you with a SCIM API and bearer token to connect to. We support syncing users (create/update/deactivate), as well as groups. You will need to configure and test SCIM in your IdP.

Uniform will configure SCIM using userName as the user ID attribute. It will also extract full name from displayName, email from the emails[primary eq true].value attribute, use active to enable or disable the user, and accepts avatar URLs from photos[type eq "photo"].value (optional). This mapping can be altered on request.

Ensure that you only sync users or groups that will have access to Uniform over SCIM - don't sync all groups or all users.

5. Assign Uniform roles from your directory groups#

If you are using SCIM or asserting a group attribute, Uniform will activate groups mapping on your Uniform team. You can bind a Uniform role to a group in your directory. Members of that group are given the role when they sign in, and lose it when they leave the group. Group mapping is configured on your Uniform roles by checking Managed by identity provider. The IdP group name is whatever you send in your group attribute or via SCIM to Uniform; for some providers, it is possible this might be a UUID or other opaque value.

Mapped team administration#

Team administration can also come from a group, so that your directory decides who administers the team. Members of that group become team admins when they sign in, and lose it when they leave the group. Uniform must configure this mapping for you; you provide us the group name and your team ID and we'll take care of it.

When changes take effect#

Group membership changes apply at the user's next sign-in. Deactivating or deleting a user in your directory is immediate as long as SCIM is being used: Uniform revokes their access, and any personal access tokens they own stop granting any permissions. Without SCIM, a team admin should remove any personal access tokens after revocation.

Maintenance#

When your signing certificate is up for renewal, provide your updated certificate to Uniform and we will install it for you.