Single Sign-On (SSO)

Single Sign-On enables your team to access Crew using your organization’s identity provider. SSO improves security, simplifies user management, and provides a seamless login experience.

SSO is available on Enterprise plans. Contact sales@usecrew.ai to enable.

Supported Providers

SAML 2.0

Provider	Status
Okta	Supported
Azure AD	Supported
Google Workspace	Supported
OneLogin	Supported
Ping Identity	Supported
Custom SAML	Supported

OIDC

Provider	Status
Okta	Supported
Azure AD	Supported
Auth0	Supported
Google	Supported

Setup

SAML Configuration

Get Crew's SAML Details

Navigate to Settings → Security → SSOCopy:

ACS URL: https://api.usecrew.ai/auth/saml/callback
Entity ID: https://api.usecrew.ai/saml/metadata
Metadata URL: https://api.usecrew.ai/saml/metadata.xml

Configure Your IdP

In your identity provider:

Create a new SAML application
Enter Crew’s ACS URL and Entity ID
Configure attribute mappings (see below)

Upload IdP Metadata

In Crew:

Upload your IdP’s metadata XML, or
Enter IdP SSO URL and certificate manually

Test Connection

Use the Test SSO button to verify configuration

Enable for Users

Choose enforcement mode and enable SSO

Required Attributes

Attribute	SAML Name	Required
Email	`email` or `NameID`	Yes
First Name	`firstName` or `givenName`	Yes
Last Name	`lastName` or `surname`	Yes
Groups	`groups`	Optional

Attribute Mapping

Configure in Crew:

{
  "attribute_mapping": {
    "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
    "firstName": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
    "lastName": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
    "groups": "http://schemas.xmlsoap.org/claims/Group"
  }
}

OIDC Configuration

Create OIDC Application

In your identity provider, create an OIDC application

Configure Redirect URI

Set redirect URI to: https://api.usecrew.ai/auth/oidc/callback

Enter Details in Crew

Client ID
Client Secret
Issuer URL
Scopes (openid, profile, email)

Test and Enable

Test the connection and enable for users

User Provisioning

Just-in-Time (JIT) Provisioning

Users are automatically created on first SSO login:

{
  "jit_provisioning": {
    "enabled": true,
    "default_role": "member",
    "auto_assign_workspace": true
  }
}

SCIM Provisioning

For automated user lifecycle management:

{
  "scim": {
    "enabled": true,
    "endpoint": "https://api.usecrew.ai/scim/v2",
    "token": "scim_token_xxxxx"
  }
}

SCIM supports:

User creation
User updates
User deactivation
Group synchronization

Group Mapping

Map IdP groups to Crew roles:

{
  "group_mapping": {
    "crew-admins": "admin",
    "crew-members": "member",
    "crew-viewers": "viewer"
  }
}

Enforcement Modes

Optional SSO

Users can choose SSO or password:

{
  "sso_enforcement": "optional"
}

Required SSO

All users must use SSO:

{
  "sso_enforcement": "required"
}

Password login is disabled when SSO is required.

Domain-Based Enforcement

Require SSO for specific email domains:

{
  "sso_enforcement": "domain",
  "sso_domains": ["yourcompany.com", "subsidiary.com"]
}

Session Management

Session Duration

Configure SSO session length:

{
  "session": {
    "max_duration_hours": 24,
    "idle_timeout_hours": 4,
    "require_reauth_for_sensitive": true
  }
}

Single Logout (SLO)

Enable single logout to end sessions across all applications:

{
  "single_logout": {
    "enabled": true,
    "logout_url": "https://api.usecrew.ai/auth/slo"
  }
}

Security Features

MFA via IdP

When SSO is enabled, MFA is enforced through your identity provider.

Session Controls

Force re-authentication for sensitive actions
Configurable session timeouts
Device tracking and management

IP Restrictions

Combine SSO with IP allowlisting:

{
  "access_restrictions": {
    "allowed_ips": ["203.0.113.0/24"],
    "sso_bypass_allowed": false
  }
}

Provider-Specific Guides

Okta

Create new SAML 2.0 application
Set Single Sign On URL to Crew’s ACS URL
Set Audience URI to Crew’s Entity ID
Configure attribute statements:
- email → user.email
- firstName → user.firstName
- lastName → user.lastName
Download metadata XML
Upload to Crew

Azure AD

Create Enterprise Application
Select SAML single sign-on
Configure Basic SAML:
- Identifier: Crew Entity ID
- Reply URL: Crew ACS URL
Configure Attributes & Claims:
- Add email, givenname, surname claims
Download Federation Metadata XML
Upload to Crew

Google Workspace

Go to Admin Console → Apps → SAML Apps
Add custom SAML app
Configure Service Provider Details:
- ACS URL: Crew’s ACS URL
- Entity ID: Crew’s Entity ID
Map attributes:
- Primary email → email
- First name → firstName
- Last name → lastName
Download IdP metadata
Upload to Crew

Troubleshooting

Common Issues

Issue	Cause	Solution
”Invalid SAML response”	Certificate mismatch	Re-upload IdP certificate
”User not found”	Email mismatch	Verify email attribute mapping
”Access denied”	Group not mapped	Update group mappings
Redirect loop	Incorrect ACS URL	Verify ACS URL in IdP

Debug Mode

Enable debug logging for troubleshooting:

{
  "sso_debug": {
    "enabled": true,
    "log_assertions": true
  }
}

Disable debug mode after troubleshooting. It may log sensitive data.

Testing

Use the SSO test tool:

Go to Settings → Security → SSO
Click Test SSO Login
Review the test results for errors

Audit Logging

SSO events are logged:

Event	Description
`sso.login.success`	Successful SSO login
`sso.login.failure`	Failed SSO attempt
`sso.logout`	SSO logout
`sso.config.updated`	SSO settings changed
`sso.user.provisioned`	JIT user created

Best Practices

Test before enforcing

Test SSO with a few users before requiring it for everyone.

Keep a break-glass account

Maintain one admin account with password login for emergencies.

Use group mapping

Automate role assignment through IdP groups.

Configure session timeouts

Set appropriate session durations based on security requirements.

Enable SCIM for large teams

Automate user lifecycle with SCIM provisioning.

Next Steps

Security Overview — Security architecture
Authentication — API authentication
Audit Logs — Access logging

​Single Sign-On (SSO)

​Supported Providers

​SAML 2.0

​OIDC

​Setup

​SAML Configuration

​Required Attributes

​Attribute Mapping

​OIDC Configuration

​User Provisioning

​Just-in-Time (JIT) Provisioning

​SCIM Provisioning

​Group Mapping

​Enforcement Modes

​Optional SSO

​Required SSO

​Domain-Based Enforcement

​Session Management

​Session Duration

​Single Logout (SLO)

​Security Features

​MFA via IdP

​Session Controls

​IP Restrictions

​Provider-Specific Guides

​Okta

​Azure AD

​Google Workspace

​Troubleshooting

​Common Issues

​Debug Mode

​Testing

​Audit Logging

​Best Practices

​Next Steps

Single Sign-On (SSO)

Supported Providers

SAML 2.0

OIDC

Setup

SAML Configuration

Required Attributes

Attribute Mapping

OIDC Configuration

User Provisioning

Just-in-Time (JIT) Provisioning

SCIM Provisioning

Group Mapping

Enforcement Modes

Optional SSO

Required SSO

Domain-Based Enforcement

Session Management

Session Duration

Single Logout (SLO)

Security Features

MFA via IdP

Session Controls

IP Restrictions

Provider-Specific Guides

Okta

Azure AD

Google Workspace

Troubleshooting

Common Issues

Debug Mode

Testing

Audit Logging

Best Practices

Next Steps