SAML single sign-on
Sign in to Sprooster through your identity provider (Entra ID, Okta, or anything that speaks SAML 2.0).
With SAML SSO your people sign in to Sprooster through your identity provider, the same place they sign in to everything else. It works with any SAML 2.0 IdP: Microsoft Entra ID, Okta, JumpCloud, OneLogin, Ping, and others.
SAML handles login only. Your org chart still fills from a directory connection (Microsoft 365, Google Workspace, or CSV). The two are independent, and most workspaces run both.
Setup is concierge for now: you send us one thing, we send you three values back, done in a day. Email help@sprooster.com to start.
1. Send us your IdP metadata
Create a SAML app in your identity provider (name it Sprooster) and send us its
metadata URL (preferred) or the metadata XML file. That's the only input we need:
it carries your sign-on URL, issuer, and signing certificate.
- Entra ID: Entra admin center → Enterprise applications → New application → Create your own → Integrate any other application. After creating, the App Federation Metadata Url is under Single sign-on → SAML Certificates.
- Okta: Applications → Create App Integration → SAML 2.0. The Metadata URL is on the app's Sign On tab. (Okta asks for the SP values during creation. Use placeholders, then update with the real values from step 2.)
2. Enter the Sprooster values we send back
We'll reply with the three service-provider values your IdP asks for:
| Your IdP calls it | Sprooster value |
|---|---|
| Identifier / Entity ID / Audience URI | https://<app>/api/saml |
| Reply URL / ACS URL / Single sign-on URL | https://<app>/api/saml/acs |
| Sign-on start URL (for your intranet link) | https://<app>/api/saml/authorize?domain=<your-domain> |
Make sure the app asserts an email address, either as the NameID (email format) or as the standard email claim. Entra and Okta both do this by default.
3. Sign in
Your people use the start URL. Link it from your intranet, password manager, or IdP dashboard tile. It sends them to your IdP; after your IdP confirms who they are, they land in Sprooster signed in.
First-time users are created on the spot. Whether they see the org chart follows the same membership rules as every other sign-in: being in the synced directory, an admin approval, or an invite.
Notes for IT admins
- Sign-in is SP-initiated: always start from the Sprooster start URL. Testing with your IdP's own "test sign-in" button (IdP-initiated) is rejected by design. Tell us if your rollout needs it.
- Only emails under your workspace's registered domains can sign in through your SSO connection. Ask us to register additional domains if your people use several.
- Certificate rollover: send us the new metadata before the old certificate expires. We store all published certificates, so old and new certificates both keep working during the rollover.
- Assertions must be signed, at the response or the assertion level (both work). Encrypted assertions aren't supported yet; leave encryption off.