Setting up SAML single sign-on

Overview

Arthiva supports single sign-on with any SAML 2.0 identity provider — Okta, Microsoft Entra ID, Google Workspace, and Keycloak all work. Configuration lives in Settings → SSO and is available to organization admins.

Step 1 — Enter your identity provider's details

On the Identity Provider card, either click Upload IdP XML to import the metadata file your IdP admin gave you — it fills in the fields for you — or enter them by hand:

• IdP Entity ID — your IdP's issuer identifier.
• IdP SSO URL — where sign-in requests are sent.
• IdP Logout URL — optional.
• IdP X.509 Signing Certificate (PEM) — paste the PEM, or use Upload certificate with a .pem, .crt, or .cer file; binary DER files are converted automatically.
• Email attribute name — defaults to email. This attribute is matched against the email a user was invited with.

Click Save configuration.

Step 2 — Give Arthiva's details to your IdP

The bottom of the Identity Provider card shows the three service-provider values your IdP admin needs, each with a copy button:

• SP Entity ID
• ACS URL — where your IdP posts the signed assertion.
• Metadata XML — a link your IdP can import directly.

Assertions must be signed; Arthiva validates the signature, audience, destination, and validity window on every login. Both service-provider-initiated sign-in and IdP-initiated sign-in (launching Arthiva from your Okta, Entra, or Google app dashboard) are supported.

Step 3 — Add your email domains

On the Email domains card, add the domains your team's email addresses live on (for example acme.com). When someone types an email from one of these domains on the sign-in page, they're routed straight to your SSO. A domain can belong to only one organization.

Verifying it works

Have someone who's already been invited sign in through your IdP, then check the Recent SSO activity card — it shows the last 10 SSO login attempts with success or failure and the reason, plus 24-hour success/failure counters. Two failures worth knowing:

• An email your IdP asserts that was never invited is refused — the user sees that their account hasn't been set up yet and should ask a workspace admin for an invite.
• An email registered to a different Arthiva organization is refused.

When you're satisfied, move on to Enforcing SSO.