Admins can connect a workspace to an identity provider (IdP) such as Okta, Microsoft Entra ID or Google Workspace. Tried supports three building blocks, configured on Settings, Security:
| Feature | Standard | What it does |
|---|---|---|
| Single sign-on (OIDC) | OpenID Connect, authorization code flow | People on your email domains sign in through the IdP |
| Single sign-on (SAML) | SAML 2.0, HTTP POST binding | The same, for IdPs that use SAML |
| User provisioning (SCIM) | SCIM 2.0 (RFC 7643 and 7644) | The IdP creates, updates and removes members and sets their roles |
Each email domain can belong to only one workspace across Tried for OIDC, and one for SAML. Saving a domain that another workspace already uses returns One of those domains is already used by another workspace.
OIDC single sign-on#
Register Tried in your IdP#
Create an OIDC web application. Use the Redirect URI for your IdP shown on the page: https://api.tried.com.au/auth/sso/callback. Request the openid email profile scopes.
Fill in the form#
On Settings, Security, under Single sign-on (OIDC), enter the Issuer URL, Client ID, Client secret and one or more Email domains (bare domains like example.com, up to 20). Click Save SSO.
Sign in#
On the sign-in page, enter an email on one of the domains. Tried checks POST /auth/sso/start and redirects to the IdP. After the IdP returns, the person lands on Home.
How Tried verifies the sign-in:
- The issuer is discovered from
<issuer>/.well-known/openid-configuration. - The ID token is verified against the issuer's JWKS (RS256 or ES256), including
iss,aud,expand thenoncesent at the start. - The
stateparameter is signed and expires after 10 minutes. - An email the IdP marks as unverified (
email_verified: false) is rejected. - The email domain must be one of the configured domains.
People who are not yet members join as Member on their first SSO sign-in. Change their role on Settings, Workspace, or manage roles with SCIM. Each SSO sign-in is recorded as auth.sso_login in the audit log.
| API (admin) | Purpose |
|---|---|
GET /workspace/sso |
Current configuration (has_client_secret instead of the secret) |
PUT /workspace/sso |
issuer, client_id, client_secret, domains, enabled |
DELETE /workspace/sso |
Remove the configuration |
SAML single sign-on#
Single sign-on (SAML) works with Okta, Entra ID, Google Workspace and other SAML 2.0 IdPs.
Give your IdP the Tried values#
The SAML section lists SP entity ID, ACS URL and the metadata URL for your workspace. The ACS URL has the form https://api.tried.com.au/auth/saml/<workspace_id>/acs, and metadata is served at https://api.tried.com.au/auth/saml/<workspace_id>/metadata.
Enter your IdP's values#
Fill in IdP sign-in URL, IdP entity ID and IdP signing certificate (PEM, starting with -----BEGIN CERTIFICATE-----). Add your Email domains and pick the Role for new people (Admin, Developer or Member; default Member). Click Save SAML.
Test a sign-in#
Start a sign-in for an email on the domain. The IdP posts a signed assertion to the ACS URL and the person lands on Home.
Rules applied to each assertion:
- The signature must validate against the saved certificate.
- The assertion must contain an email. Its domain must be in the configured domains.
- New people join with the Role for new people. Existing members keep their role.
- Each sign-in is recorded as
auth.saml_login. Saving the configuration is recorded asworkspace.saml_update.
Once a certificate is saved, the form shows A certificate is saved. Paste a new one to replace it. The certificate is never returned by the API (has_idp_cert: true).
| API (admin) | Purpose |
|---|---|
GET /workspace/saml |
Configuration plus sp_entity_id, acs_url, metadata_url |
PUT /workspace/saml |
idp_sso_url, idp_entity_id, idp_cert, domains, enabled, default_role |
DELETE /workspace/saml |
Remove SAML |
POST /auth/saml/start |
{ "email": ... } returns { "saml": true, "redirect_url": ... } for a SAML domain |
The dashboard sign-in page checks OIDC SSO domains when you type an email. SAML sign-in starts from POST /auth/saml/start, which your own sign-in link or portal can call.
Test identity providers#
For local development, Tried includes mock OIDC and SAML identity providers that ask only for an email and check no password. Set the OIDC issuer to the mock issuer, or idp_sso_url to mock for SAML, and the section shows On (test IdP). Mock providers are unavailable in production unless ENABLE_MOCK_AUTH=1 is set.
SCIM provisioning#
User provisioning (SCIM) lets your IdP add, update and remove workspace members automatically.
Turn on SCIM#
Click Turn on SCIM. Tried creates a bearer token that starts with scim_. Copy it now: it won't be shown again. Only a SHA-256 hash is stored, with a short hint for display.
Configure your IdP#
Use the Base URL shown (https://api.tried.com.au/scim/v2) and the token as the bearer token.
Push users and groups#
The section shows how many users and groups have been Provisioned.
What SCIM changes#
| SCIM operation | Effect in Tried |
|---|---|
Create a user (active: true) |
Creates the user if needed and adds them as a member |
Set active: false, or delete the user |
Removes the membership and signs out their sessions in this workspace |
| Add a user to a group | Grants the role named by the group |
| Remove from a group | Role is recalculated from remaining groups |
Group names map to roles by the word they contain: a name containing admin grants Admin, developer or dev grants Developer, member grants Member. A member's role is the highest role among their groups. Users in no role group are added as Member. SCIM never removes or demotes the last admin of a workspace.
Supported endpoints under /scim/v2: ServiceProviderConfig, ResourceTypes, Users and Groups (list, create, get, replace with PUT, PATCH, delete). Filters support attr eq "value" on userName, externalId, emails.value and displayName.
Rotate token creates a new token and the old one stops working immediately (audited as workspace.scim_token_rotate). Turning SCIM off revokes the token; members already provisioned stay in the workspace.
| API (admin) | Purpose |
|---|---|
GET /workspace/scim |
enabled, token_hint, base_url, user and group counts |
POST /workspace/scim-token |
Create or rotate the token |
DELETE /workspace/scim-token |
Turn SCIM off |