Single sign-on (SSO)

Overview

Allocentra acts as a SAML 2.0 service provider (SP). Your identity provider (IdP) authenticates users and posts a SAML assertion back to Allocentra. Users must already exist in your workspace with an email that matches the SAML NameID.

Service provider values

Copy these from Settings → SSO or use the values below:

Azure AD (Entra ID)

1. Azure portal → Enterprise applications → New application → Create your own (non-gallery).
2. Set up single sign-on → SAML.
3. Identifier (Entity ID): https://api.allocentra.co.za/api/v1/auth/sso/metadata/
4. Reply URL (ACS): https://api.allocentra.co.za/api/v1/auth/sso/acs/
5. Edit attributes — set Unique User Identifier (Name ID) to user.mail or user.userprincipalname.
6. Copy the IdP Entity ID, Login URL, and X.509 certificate into Allocentra SSO settings.
7. Assign users or groups who should access Allocentra.

Okta

1. Create a new SAML 2.0 app integration.
2. Single sign-on URL = ACS URL above; Audience URI = SP Entity ID.
3. Name ID format: EmailAddress.
4. Attribute statements: email → user.email.
5. Paste IdP metadata (issuer, SSO URL, cert) into Allocentra.

Google Workspace

1. Admin console → Apps → Web and mobile apps → Add custom SAML app.
2. ACS URL and Entity ID as above.
3. Name ID: Basic information → Primary email.
4. Download the Google IdP certificate and enter SSO URL + entity ID in Allocentra.

Enable SSO in Allocentra

1. Settings → SSO → enter IdP Entity ID, SSO URL, and PEM certificate.
2. Enable SSO and save.
3. Test from the login page: enter your email → Continue with SSO.
4. Optional: enable Enforce SSO to block password login for the workspace.

Troubleshooting SSO

• No matching user — create the user in Allocentra first with the same email as the IdP NameID.
• SSO not configured — confirm SSO is enabled and IdP URLs are saved.
• Certificate errors — paste the full PEM including BEGIN/END CERTIFICATE lines.