SSO & SCIM Provisioning

SSO & SCIM Provisioning

Enterprise workspaces can connect a SAML 2.0 identity provider for centralized sign-in, and optionally layer SCIM 2.0 on top for automatic user provisioning. These live on three separate pages under workspace administration: Single Sign-On, Verified Domains, and SCIM Provisioning.

Single Sign-On

Location: Workspace → Administration → Single Sign-On

Connecting an Identity Provider

Upload your identity provider's SAML metadata as an XML file — drag and drop it onto the upload area, or click to browse. There's no paste-XML or metadata-URL option; a file is the only input.

• File requirements: .xml extension, max 1 MB.
• Saving creates the connection disabled — nothing routes to it until you turn on Connection enabled.

Once connected, the page shows the service provider details you give back to your identity provider when creating the Qualflare application there:

The signing certificate has an expiration date shown on this card. You can rotate the certificate at any time — doing so immediately invalidates the old one, so re-upload the new metadata to your identity provider right away or sign-in will fail until you do.

Attributes and Role Mapping

Configure how identity provider claims map onto a Qualflare profile and role:

• Profile attributes: email, display name, first name, last name claim names. Leave blank to try standard claim names automatically.
• Group attribute: the SAML claim holding the user's group memberships.
• Role rules: an ordered list mapping a group-name match to a role (Viewer, Editor, or Maintainer). The first matching rule wins — reorder rules with the up/down controls to control precedence. Duplicate matches are flagged; only the first ever fires.
• Default role: applied when no rule matches.
• Re-apply roles on every sign-in: when on, a member's role is recomputed from the current rules at every login (manual role changes in Qualflare are overwritten). Workspace owners are never changed by this. Roles pushed via SCIM group sync take precedence over this setting.

If no group attribute is set, role rules have no effect on SAML sign-ins — everyone gets the default role. Rules still apply to groups synced over SCIM.

Verified Domains

Location: Workspace → Administration → Verified Domains (requires a connection first)

Members whose email matches a verified domain are routed to your identity provider at login.

1. Enter a domain (e.g. acme.com) and click Add domain.
2. Publish the shown DNS TXT record at your domain registrar.
3. Click Verify once the record is live.

Each domain row shows its verification status (Pending / Verified) and the exact record to publish — the record stays visible after verification for auditing. You can regenerate a domain's token (invalidates the old TXT value) or remove a domain at any time; removing one just stops routing for that domain, it doesn't affect existing members.

Enforcing SSO

The Require SSO for all members switch (in the connection's Danger Zone) disables password and social sign-in workspace-wide, including for owners.

Before you can turn it on:

• At least one verified domain must exist.
• Someone must have successfully completed a real SSO sign-in through the connection — this is enforced server-side, not just a UI check.

Removing a Connection

Deletes the SAML configuration and all verified domains. Disabled while Require SSO for all members is on — turn off enforcement first.

Recovering from a Lockout

If a workspace locks itself out of SSO, contact Qualflare support. Support can disable the connection from the admin side, which also turns off the SSO requirement in the same action so password login works again immediately.

---

SCIM Provisioning

Location: Workspace → Administration → SCIM Provisioning (requires a working SSO connection first)

SCIM lets your identity provider automatically create, update, and remove Qualflare workspace members to match your directory — supported by Okta and Microsoft Entra ID.

Setup

1. Click Generate token. The plaintext token is shown exactly once — copy it immediately, it cannot be retrieved again later (only a masked prefix is shown afterward).
2. Paste the SCIM base URL and the token into your identity provider (Okta: "Base URL" / "API Token"; Entra: "Tenant URL" / "Secret Token").
3. Turn on Provisioning enabled. This is a separate step from generating the token on purpose — minting a credential and arming an endpoint that can remove members are different decisions.

Regenerate replaces the token immediately (paste the new one into your identity provider or provisioning breaks). Revoke clears the token and turns provisioning off in the same action — nothing already provisioned is undone, but no further changes apply.

Provisioning Behavior

• A user can only be provisioned into a verified domain — this is what stops a directory from silently granting access to an outside address. If your identity provider's directory includes people outside your verified domains, they'll fail to provision.
• The last remaining workspace Owner cannot be deprovisioned or removed by SCIM.
• Groups pushed over SCIM are matched against the same role rules configured under SSO attribute mapping.

Troubleshooting

Related

• Workspace Settings
• Users & Roles
• Account Security