Skip to main content
Single Sign-On (SSO) lets your team authenticate to Zwiron using your existing identity provider (IdP). Zwiron supports SAML 2.0, which is compatible with Okta, Azure AD / Entra ID, Google Workspace, OneLogin, JumpCloud, and any other SAML 2.0-compliant IdP.
SSO is an Enterprise feature. Contact sales to enable it for your organization.

​
How it works

  1. You configure your SAML identity provider to trust Zwiron as a service provider
  2. You configure Zwiron with your IdP’s metadata URL or entity ID
  3. When a user from your domain logs in to Zwiron, they are redirected to your IdP to authenticate
  4. Your IdP returns a SAML assertion to Zwiron, confirming the user’s identity
  5. Zwiron creates or updates the user’s account and logs them in

​
Configuration

In your identity provider:
  1. Create a new SAML application
  2. Set the ACS URL (Assertion Consumer Service URL) to:
  3. Set the Entity ID / Audience to:
  4. Map the following attributes:
    • email → user’s email address
    • name (optional) → user’s display name
In Zwiron:
  1. Go to Settings → SSO
  2. Enter your IdP’s Metadata URL (preferred) — Zwiron fetches the configuration automatically, or enter the Entity ID and certificate manually
  3. Click Save and test to verify the connection

​
Domain enforcement

Enable Enforce SSO to require that all users with your domain (e.g. @yourcompany.com) log in via SSO. Users who previously had password accounts will be required to use SSO from that point on.
Enforce SSO carefully. If your IdP is misconfigured when you enable enforcement, users in your domain may be locked out.

​
Just-in-time provisioning

When SSO is enabled, users who successfully authenticate via your IdP are automatically created in Zwiron if they don’t exist yet (JIT provisioning). They are assigned the Viewer role by default. An admin can then change their role in Settings → Team.

​
Supported providers (tested)

  • Okta
  • Azure Active Directory / Microsoft Entra ID
  • Google Workspace (SAML)
  • OneLogin
  • JumpCloud
  • Ping Identity
  • Any SAML 2.0-compliant IdP

​
Disabling SSO

Go to Settings → SSO → Disable SSO. Users can log in with their email and password again. If they don’t have a password set (because they always used SSO), they can use Forgot password to set one.
Last modified on July 13, 2026