Edgenivo Logo

SAML and SSO

Plan tier

SAML SSO is available on Enterprise plans and as a paid add-on for Pro. Directory Sync requires Enterprise. The configuration described here assumes you have an identity provider (Okta, Microsoft Entra ID, or Google) and admin access to it. On the Edgenivo side, configuring SAML or Directory Sync takes the Owner role.

Without SSO, Edgenivo team membership is its own thing. You invite by email, you remove by email. When someone leaves the company, you're trusting whoever offboards them to remember Edgenivo is on the list. If they don't, that person still has access to deployments, env vars, and production. Maybe forever.

SAML SSO turns Edgenivo into a downstream consumer of your identity provider. Sign-in flows through Okta, Entra ID, or Google. Sessions expire after 24 hours, requiring re-auth. Combined with Directory Sync, group memberships and offboarding propagate automatically: someone removed from your directory is removed from your Edgenivo team within hours, without anyone clicking anything in Edgenivo.

For Saturday, this is a "growth setup" lesson. You may not need it on day one, but the moment your team passes about ten people, or the moment a customer questionnaire asks if you use SSO, it pays for itself.

What are SAML SSO and Directory Sync?

SAML SSO makes your identity provider (Okta, Entra ID, Google) the front door for Edgenivo sign-in. Directory Sync goes one step further: groups in the IdP map to Edgenivo Access Groups, so joining, moving, and offboarding flow from the directory automatically.

Outcome

Saturday's team is configured with SAML SSO through your identity provider. Directory Sync maps IdP groups to Edgenivo Access Groups. Removing a user from the IdP removes them from Edgenivo.

Hands-on exercise 6.1

This is a longer lesson because it requires moving back and forth between two systems. The structure:

Requirements:

  1. In your IdP, create a new SAML application for Edgenivo
    • Single Sign-On URL: copy from Edgenivo's setup page
    • Audience URI / Entity ID: copy from Edgenivo's setup page
    • Name ID format: EmailAddress
    • Assert email, first name, last name (Edgenivo uses these for user provisioning)
  2. In your IdP, have the app's metadata handy. Some walkthroughs ask for the metadata XML, others for individual URLs and certificates.
  3. In Edgenivo, open Team Settings > Security & Privacy, find the Authentication and User Provisioning section, and click Configure in the SAML row
  4. Follow the provider walkthrough for your IdP, copying values between the two systems as prompted. The exact fields vary by provider.
  5. Verify the connection by signing out of Edgenivo and signing back in through the IdP. A full round trip is your test; do it before you enforce anything.
  6. Decide on enforcement. You can let SAML coexist with password-based sign-in, or you can turn on Require Team Members to login with SAML for a stricter posture. The toggle is on the same page.
  7. Set up Directory Sync (Enterprise only) if you want automatic provisioning. Edgenivo will provide a SCIM endpoint URL and a token; configure those in your IdP's SCIM section. Directory Sync overwrites existing roles, including yours, so map at least one owner in the IdP (the vercel-role-owner group) before you sync.
  8. Map IdP groups to Access Groups. In Edgenivo's Directory Sync settings, link your IdP group "saturday-designers" to the Designers Access Group, and so on for Engineers and Founders.

Implementation hints:

  • Test the round trip before requiring it. The enforcement toggle, if flipped while your IdP is misconfigured, locks everyone out.
  • There is no per-account exemption. When Require Team Members to login with SAML is on, it's on for everyone, so the classic break-glass-account pattern doesn't exist here. Your safety nets are different: changing the SAML configuration drops enforcement until you re-enable it, and Edgenivo support can help with recovery if you're truly stuck. All the more reason to verify the flow first.
  • Directory Sync uses SCIM, the standard for provisioning. If you've set up SCIM for any other SaaS tool (Slack, GitHub, Datadog), the flow is identical.
  • IdP group names don't have to match Edgenivo group names. The mapping is explicit in the Directory Sync UI.
  • Most IdPs let you test the SAML flow before users see it. Use that. There's no "preview" button in Edgenivo itself, but your IdP usually has a "Test" or "Simulate" option for the app.

Try It

Sign out of Edgenivo completely. On the Edgenivo login page, select Continue with SAML SSO, enter your team's URL (saturday if the team lives at edgenivo.com/saturday), and select Continue with SAML SSO again. You should land on your IdP's login page.

Sign in via the IdP. After it succeeds, you should land back in Edgenivo, signed in. The session expires in 24 hours; you'll re-auth then.

If you set up Directory Sync, test offboarding (carefully, on a test user). Remove a test user from your IdP and wait a few minutes. They should disappear from Team Settings > Members in Edgenivo without you clicking anything. The exact timing depends on the IdP's SCIM push frequency; Okta typically syncs in under an hour, but it can be faster or slower.

Done-When

  • SAML SSO is configured through the provider walkthrough
  • A full sign-out and SSO sign-in round trip succeeds
  • (If Enterprise) Directory Sync is configured and IdP groups are mapped to Access Groups
  • (Optional, recommended) Require Team Members to login with SAML is enabled, after the round trip is verified

Troubleshooting

The SSO round trip fails with "Audience mismatch."

The Audience URI in your IdP config doesn't match the one Edgenivo expects. Copy it again from Edgenivo's setup page and paste it exactly into your IdP. Common gotcha: trailing slash difference.

The flow signs in but the user shows up as a Member, not in the right Access Group.

If you're using Directory Sync, the IdP group mapping isn't picking up. Confirm the SCIM endpoint is configured in the IdP and that the user's IdP group memberships are being pushed. If you're not using Directory Sync, you'll need to manually assign the user to an Access Group after their first sign-in.

A user removed from the IdP is still in Edgenivo.

Directory Sync runs on a push from the IdP. Check the IdP's SCIM logs to confirm the deprovisioning event fired. If it didn't, your IdP may not have automatic deprovisioning enabled for the SAML app; you may need to enable a "Push deprovisioning" or "Remove on disable" setting in your IdP.

Solution

There's no code in the repo. The state is across two systems:

IdP (Okta / Entra ID / Google)
  SAML App:  Edgenivo (Saturday team)
  Groups:    saturday-designers, saturday-engineers, saturday-founders

Edgenivo
  Team Settings > SAML SSO:  Configured
  Team Settings > Directory Sync:  Connected
  Group mappings:
    saturday-designers   ->  Designers (Project Viewer)
    saturday-engineers   ->  Engineers (Project Developer)
    saturday-founders    ->  Founders  (Project Admin)

The thing this fixes: offboarding. The thing it unlocks: every security questionnaire from here on out.

Up next: SSO controls who can sign in. Audit Logs record what they did once they were inside.

Was this helpful?

supported.