SSO setup FAQ for IT admins
Answers for the IT admin connecting their identity provider to an app that uses Scalekit for SSO: setup values, attributes, signing, certificates, testing and data.
This page is for the IT admin who has been asked to set up single sign-on (SSO) for an app, here called “the app”, that uses Scalekit. It answers the questions IT and security teams ask most often. For step-by-step setup in your identity provider (IdP), use the guide for your IdP.
What is Scalekit, and why does the app use it?
Section titled “What is Scalekit, and why does the app use it?”Scalekit connects the app to your IdP. Your IdP signs users in and sends the result to Scalekit over SAML or OpenID Connect (OIDC). Scalekit checks the response and passes the signed-in user’s profile to the app. In SAML terms, Scalekit is the service provider (SP); in OIDC terms, it’s the relying party.
The app keeps its own accounts and sessions. Scalekit doesn’t sign users in on its own or change anything in your directory.
How do I set it up?
Section titled “How do I set it up?”- The app’s team sends you a link to the SSO Configuration Portal. It’s specific to your organization.
- In the portal, choose your IdP and protocol. The portal shows the values your IdP needs, such as the SSO URL.
- Create an app in your IdP with those values, assign the users or groups who should have access, and enter your IdP’s details in the portal.
- Select Test Connection in the portal and sign in as a test user.
Each IdP guide walks through these steps with screenshots.
Which values do I enter in my IdP?
Section titled “Which values do I enter in my IdP?”Copy them from the SSO Configuration Portal. Each connection has its own values; the domain is the app’s Scalekit domain or a custom domain the app has set up.
| Protocol | Value | Format |
|---|---|---|
| SAML | SSO URL (assertion consumer service URL) | https://<domain>/sso/v1/saml/<connection-id>/callback |
| SAML | Audience URI (SP entity ID) | https://<domain>/sso/v1/saml/<connection-id> |
| OIDC | Redirect URI | https://<domain>/sso/v1/oidc/<connection-id>/callback |
For OIDC, create a confidential client (web app) with a client secret. Scalekit requests the openid, email and profile scopes.
Which user attributes do I need to send?
Section titled “Which user attributes do I need to send?”| Attribute | SAML attribute name | OIDC claim | Required |
|---|---|---|---|
| A stable user ID | NameID | sub | Yes |
| Email address | email | email | Yes |
| First name | firstName | given_name | No, but without it the app may not have the user’s name |
| Last name | lastName | family_name | No, but without it the app may not have the user’s name |
The app’s team may also ask for groups or another attribute, for example to set each user’s role in the app. Send them with the names the team gives you.
Send a user ID that doesn’t change when a user is renamed. For SAML, an email-format NameID is the default; if your users’ email addresses change, prefer a persistent ID.
Does the SAML response need to be signed or encrypted?
Section titled “Does the SAML response need to be signed or encrypted?”Sign the response, the assertion or both; Scalekit rejects a response where neither is signed. Use SHA-256 or stronger. Encrypted assertions are optional; Scalekit decrypts them if you encrypt them.
For the full list of checks Scalekit runs on each response, see SAML response validation.
Can users sign in from our IdP’s dashboard?
Section titled “Can users sign in from our IdP’s dashboard?”Yes. Users can launch the app from a tile in your IdP’s dashboard, such as the Okta or Microsoft My Apps dashboard. Scalekit sends them to the app, which starts a new sign-in through your IdP, so users don’t sign in twice. The app’s team needs to have set this up; if launching from the tile fails, tell them.
What happens when our signing certificate expires?
Section titled “What happens when our signing certificate expires?”That depends on how the connection was set up:
- With your IdP’s metadata URL: Scalekit reads the metadata at each sign-in, so it picks up a new certificate as soon as your IdP uses it. Nothing to update.
- With an uploaded certificate: sign-in fails once the certificate expires. Before it does, upload the new certificate in the SSO Configuration Portal.
Use a metadata URL where your IdP offers one.
How do I test the connection?
Section titled “How do I test the connection?”Select Test Connection in the SSO Configuration Portal and sign in through your IdP. On success, the portal lists the attributes Scalekit received, so you can check that the email address and names arrive. On failure, it shows the error and how to fix it.
The SSO Configuration Portal shows a blank page
Section titled “The SSO Configuration Portal shows a blank page”Your network is likely blocking files the portal loads. Allow the portal’s domain, which is in the link you were sent, and Google Fonts (fonts.googleapis.com and fonts.gstatic.com).
Where is our data stored, and is Scalekit audited?
Section titled “Where is our data stored, and is Scalekit audited?”- Region: the app chooses the US or EU region when it signs up for Scalekit. Your connection settings and sign-in logs stay in that region. See Data residency.
- What Scalekit receives: the attributes your IdP sends in each sign-in response, which you control in your IdP’s app settings.
- Audits: Scalekit has a SOC 2 Type II report and an annual third-party penetration test. Request them from the Scalekit Trust Center.
Which identity providers work?
Section titled “Which identity providers work?”Most IdPs that support SAML 2.0 or OIDC work. There are step-by-step guides for Okta, Microsoft Entra ID, Microsoft AD FS, Google Workspace, JumpCloud, OneLogin, Ping Identity and Shibboleth, plus generic SAML and OIDC. See the list of SSO integrations.
Who do I contact for help?
Section titled “Who do I contact for help?”Contact the app’s team first: they own the connection and can see its sign-in logs. They can bring in Scalekit support if needed.