> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zwiron.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO / SAML

> Enable SAML 2.0 single sign-on for Zwiron with Okta, Entra ID, Google Workspace, and other IdPs.

**Single Sign-On (SSO)** lets your team authenticate to Zwiron using your existing identity provider (IdP). Zwiron supports SAML 2.0, which is compatible with Okta, Azure AD / Entra ID, Google Workspace, OneLogin, JumpCloud, and any other SAML 2.0-compliant IdP.

<Info>SSO is an Enterprise feature. Contact sales to enable it for your organization.</Info>

***

## How it works

1. You configure your SAML identity provider to trust Zwiron as a service provider
2. You configure Zwiron with your IdP's metadata URL or entity ID
3. When a user from your domain logs in to Zwiron, they are redirected to your IdP to authenticate
4. Your IdP returns a SAML assertion to Zwiron, confirming the user's identity
5. Zwiron creates or updates the user's account and logs them in

***

## Configuration

**In your identity provider:**

1. Create a new SAML application
2. Set the **ACS URL** (Assertion Consumer Service URL) to:
   ```
   https://zwiron.com/auth/saml/callback
   ```
3. Set the **Entity ID / Audience** to:
   ```
   https://zwiron.com
   ```
4. Map the following attributes:
   * `email` → user's email address
   * `name` (optional) → user's display name

**In Zwiron:**

5. Go to **Settings** → **SSO**
6. Enter your IdP's **Metadata URL** (preferred) — Zwiron fetches the configuration automatically, or enter the **Entity ID** and certificate manually
7. Click **Save and test** to verify the connection

***

## Domain enforcement

Enable **Enforce SSO** to require that all users with your domain (e.g. `@yourcompany.com`) log in via SSO. Users who previously had password accounts will be required to use SSO from that point on.

<Warning>Enforce SSO carefully. If your IdP is misconfigured when you enable enforcement, users in your domain may be locked out.</Warning>

***

## Just-in-time provisioning

When SSO is enabled, users who successfully authenticate via your IdP are automatically created in Zwiron if they don't exist yet (JIT provisioning). They are assigned the **Viewer** role by default. An admin can then change their role in **Settings** → **Team**.

***

## Supported providers (tested)

* Okta
* Azure Active Directory / Microsoft Entra ID
* Google Workspace (SAML)
* OneLogin
* JumpCloud
* Ping Identity
* Any SAML 2.0-compliant IdP

***

## Disabling SSO

Go to **Settings** → **SSO** → **Disable SSO**. Users can log in with their email and password again. If they don't have a password set (because they always used SSO), they can use **Forgot password** to set one.