Single sign-on (SSO)

Single sign-on (SSO) lets your team sign in to Veribl with your company's identity provider. It works with Okta, Microsoft Entra ID, Google Workspace, or any SAML 2.0 identity provider.

SSO is available on the Growth and Enterprise plans. On Starter, the page says "Single sign-on is available on the Growth plan and up." and shows an Upgrade button.

SSO sign-in cannot add new members when your seats are full. See Team management.

You need permission to manage the team in Veribl. You also need access to your identity provider and your domain's DNS settings.

Set up SSO

Go to Settings, then Single sign-on. There are two steps.

Step 1: Verify your email domain

1. Enter your company email domain, like yourbrand.com, and click Add domain
2. Veribl shows a TXT record. Copy the host / name and the value
3. At your DNS provider, add a TXT record on your domain:
   • Name: your domain (yourbrand.com)
   • Value: veribl-sso-verification= followed by your code. Copy the whole value from Veribl.
4. Back in Veribl, click Check the record

DNS changes can take a few minutes, sometimes an hour. If the check fails, wait and try again.

Public mailbox domains, such as gmail.com or outlook.com, are not allowed. A domain that another Veribl account has already verified can't be used.

Note: If you change the domain later, you need to verify the new one and the Require single sign-on setting is switched off.

Step 2: Connect your identity provider

1. In your identity provider, create a new SAML 2.0 app
2. Enter these values (Veribl shows them with a copy button):
   • ACS URL (single sign-on URL): https://app.veribl.com/api/oauth/saml
   • Entity ID (audience): https://app.veribl.com
3. Set the NameID to the user's email address (format: email). First and last name are optional.
4. Assign the app to the people who should use Veribl
5. Copy your provider's metadata: either the XML, or an https:// metadata URL
6. In Veribl, paste it into the metadata box and click Connect

When it works, you see Connected with the provider name and the date the certificate is valid until. To use a different provider later, paste new metadata and click Replace identity provider.

Choose a role for new people

Under Role for people signing in the first time, choose:

• Member — can create and edit content
• Viewer — read only

Anyone at your domain who signs in with SSO and is not on the team yet joins automatically with this role. You can change anyone's role later in Team Management.

Require single sign-on

When the domain is verified and the provider is connected, you can switch on Require single sign-on.

Then everyone with an address at your domain must sign in through your identity provider. Passwords and Google sign-in stop working for them.

Tip: Test SSO with your own account first. Then turn on the requirement.

How your team signs in

Your team can use either way:

• On the sign-in page, click SSO, enter their work email, and click Continue with SSO
• Open the sign-in link directly: https://app.veribl.com/auth?sso=1. Veribl shows the link in Settings, then Single sign-on, once SSO is set up.

If SSO is required and someone tries a password, Veribl sends them to the SSO step.

Turn SSO off

1. Go to Settings, then Single sign-on
2. Click Turn off single sign-on and confirm

Veribl disconnects your identity provider and removes the domain setup. People sign in with a password or Google again. Anyone who has no password can set one with Forgot password.

Tips for common providers

Menu names change over time. If you can't find something, search your provider's help for "SAML app".

Okta

1. In the Okta Admin Console, go to Applications and create an app integration
2. Choose SAML 2.0
3. Enter the ACS URL as the Single sign-on URL and the Entity ID as the Audience URI
4. Set Name ID format to EmailAddress and the application username to Email
5. Assign people or groups
6. On the app's Sign On tab, copy the Metadata URL (or download the metadata XML)

Microsoft Entra ID

1. In the Entra admin center, go to Enterprise applications and create your own application (non-gallery)
2. Open Single sign-on and choose SAML
3. In Basic SAML Configuration, set Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL)
4. In Attributes & Claims, make sure the Unique User Identifier (Name ID) is the user's email address (user.mail)
5. Under Users and groups, assign people
6. In SAML Certificates, copy the App Federation Metadata Url (or download the Federation Metadata XML)

Google Workspace

1. In the Google Admin console, go to Apps, then Web and mobile apps, and add a custom SAML app
2. On the Google Identity Provider details page, download the metadata (XML)
3. Enter the ACS URL and Entity ID. Set Name ID format to EMAIL and the Name ID to Basic Information > Primary email
4. Turn the app ON for the right users or groups

Troubleshooting

• "Check the record" fails. Wait a few minutes. Make sure the TXT record is on the exact domain, with the full value.
• "Couldn't be used" when connecting. Make sure you pasted SAML metadata (it contains EntityDescriptor), or an https:// link to it.
• A user sees "Single sign-on didn't work". Check that the app is assigned to them and that the NameID is their email at the verified domain. The email domain must match the one you verified.

What SSO does not do

SSO handles sign-in only. It does not create or remove users automatically (SCIM), and signing out of your identity provider does not sign people out of Veribl. Manage who has access in Team Management.