Single Sign-On (SSO)

Configure SAML 2.0 or OIDC single sign-on with directory sync for your Demoship workspace.

SSO lets your team sign in to Demoship using your organization's identity provider. Available on Enterprise plans.

Supported protocols

SAML 2.0 -- For Okta, Azure AD, OneLogin, and other SAML-compliant providers
OIDC (OpenID Connect) -- For Google Workspace, Auth0, and OIDC-compliant providers

SAML 2.0 setup

Go to Settings > Security > SSO.
Select SAML 2.0.
Enter your Identity Provider (IdP) metadata:
- SSO URL -- Your IdP's single sign-on endpoint
- Entity ID -- Your IdP's entity identifier
- Certificate -- Your IdP's X.509 signing certificate
Copy the Demoship ACS URL and Entity ID into your IdP's configuration.
Click Test Connection to verify.
Click Enable SSO.

OIDC setup

Go to Settings > Security > SSO.
Select OIDC.
Enter your provider's configuration:
- Issuer URL -- Your OIDC provider's issuer endpoint
- Client ID -- The client ID from your OIDC application
- Client Secret -- The client secret from your OIDC application
Copy the Demoship Redirect URI into your OIDC application settings.
Click Test Connection to verify.
Click Enable SSO.

Supported providers

Demoship has been tested with:

Okta
Azure Active Directory (Entra ID)
Google Workspace
OneLogin
Auth0
PingFederate

Other SAML 2.0 or OIDC-compliant providers should work but are not officially supported.

SCIM directory sync

SCIM automates user provisioning and deprovisioning from your directory:

Go to Settings > Security > SCIM.
Copy the SCIM endpoint URL and Bearer token.
Configure your IdP's SCIM provisioning with these values.

When SCIM is enabled:

New users added to the assigned group in your IdP are automatically provisioned in Demoship
Users removed from the group are deprovisioned and lose access
Role assignments sync from your directory group mappings

With SSO enabled, users who authenticate via your IdP are automatically provisioned in Demoship on their first login, without requiring an invitation. Configure the default role for JIT-provisioned users in Settings > Security > SSO > Default Role.

Note: SSO and SCIM are available on Enterprise plans only. Contact sales to enable SSO for your workspace.