SAML single sign-on
Sign in to Sprooster through your identity provider (Entra ID, Okta, or anything that speaks SAML 2.0).
With SAML SSO your people sign in to Sprooster through your identity provider, the same place they sign in to everything else. It works with any SAML 2.0 IdP: Microsoft Entra ID, Okta, JumpCloud, OneLogin, Ping, and others.
SAML handles login only. Your org chart still fills from a directory connection (Microsoft 365, Google Workspace, or CSV). The two are independent, and most workspaces run both.
Setup lives in Settings → Single sign-on and takes about five minutes: paste one metadata URL, copy three values back into your IdP. If you'd rather we did it for you, email help@sprooster.com with your metadata URL and we'll set it up the same way from our side.
1. Create the app and copy its metadata URL
Create a SAML app in your identity provider (name it Sprooster) and find its
metadata URL (preferred) or download the metadata XML. That's the only input Sprooster
needs: it carries your sign-on URL, issuer, and signing certificate.
- Entra ID: Entra admin center → Enterprise applications → New application → Create your own → Integrate any other application. After creating, the App Federation Metadata Url is under Single sign-on → SAML Certificates.
- Okta: Applications → Create App Integration → SAML 2.0. The Metadata URL is on the app's Sign On tab. (Okta asks for the SP values during creation. Use placeholders, then update with the real values from step 2.)
2. Paste it into Sprooster
In Sprooster, open Settings → Single sign-on → Set up, paste the metadata URL (or the XML), and save. Sprooster reads the issuer, sign-on URL, and signing certificate out of it. If your IdP won't publish metadata, the same card takes the three values by hand.
3. Enter the Sprooster values in your IdP
The same card then shows the three service-provider values your IdP asks for, each with a copy button:
| Your IdP calls it | Sprooster value |
|---|---|
| Identifier / Entity ID / Audience URI | https://<app>/api/saml |
| Reply URL / ACS URL / Single sign-on URL | https://<app>/api/saml/acs |
| Sign-on start URL (for your intranet link) | https://<app>/api/saml/authorize?domain=<your-domain> |
Make sure the app asserts an email address, either as the NameID (email format) or as the standard email claim. Entra and Okta both do this by default.
4. Sign in
Your people use the start URL. Link it from your intranet, password manager, or IdP dashboard tile. It sends them to your IdP; after your IdP confirms who they are, they land in Sprooster signed in.
First-time users are created on the spot. Whether they see the org chart follows the same membership rules as every other sign-in: being in the synced directory, an admin approval, or an invite.
Notes for IT admins
- Sign-in is SP-initiated: always start from the Sprooster start URL. Testing with your IdP's own "test sign-in" button (IdP-initiated) is rejected by design. Tell us if your rollout needs it.
- Only emails under your workspace's registered domains can sign in through your SSO connection. Ask us to register additional domains if your people use several.
- Certificate rollover: re-paste the metadata URL in Settings → Single sign-on → Replace before the old certificate expires. Sprooster stores every certificate the metadata publishes, so old and new both keep working during the rollover.
- Assertions must be signed, at the response or the assertion level (both work). Encrypted assertions aren't supported yet; leave encryption off.