Single sign-on with SAML or OIDC, and SCIM

Single sign-on with SAML or OIDC, and SCIMSingle sign-on lets your people sign in to IngevoraMirage with your company's identity provider (Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud and others). It is set up for one workspace by IngevoraMirage staff, with your IT. Write to us to start.What we need from you

The email domains your people use, for example example.com. Each domain belongs to one workspace. We check with you that your company owns it. Public mail domains such as gmail.com can't be used.

SAML 2.0: your identity provider's metadata, as an XML file or the URL it is published at. We read its entity ID, its sign-in URL (HTTP-Redirect binding) and its signing certificates.

OpenID Connect: your issuer URL, a client ID and a client secret. Register this redirect URI at your provider: https://ingevoramirage.ingevora.com/auth/callback.

What you enter at your identity provider (SAML)Once the connection is saved, we send you two values for a new SAML application:

Setting

Value

Entity ID (Audience)

https://mirage-api.ingevora.com/sso/saml/<connection id>

ACS URL (HTTP-POST binding)

https://mirage-api.ingevora.com/sso/saml/<connection id>/acs

Send the person's work email as the NameID (format emailAddress), or as an attribute named email. A display name (displayName, or givenName and sn) is used for new accounts.Every response must be signed — the whole response, the assertion, or both — with a certificate from your metadata. We accept a response only for a sign-in we started (InResponseTo), only once, and within 3 minutes of clock skew. Sign-in started from your identity provider's dashboard is not supported: people start at IngevoraMirage.When your signing certificate changes, send us the new metadata before the old certificate stops.How people sign inOn the sign-in page, people choose Sign in with SSO and enter their work email. Its domain picks your connection, they sign in at your identity provider, and they come back signed in.

Two-factor sign-in still applies. If you turn on Trust this provider's two-factor, a sign-in that proves your own second step skips ours: for SAML, an AuthnContextClassRef that names a multi-factor method (for example http://schemas.microsoft.com/claims/multipleauthn or https://refeds.org/profile/mfa); for OpenID Connect, amr or acr.

A workspace can require single sign-on for the people on its domains. See Workspaces and roles.

Accounts on first sign-inWith Create accounts on first sign-in on, someone on your domains who has no account gets one the first time they sign in, and joins your workspace with the role for new people (Designer or Developer). The account has no password, and your company accepts the Terms on their behalf. They get an email: "Your company added you to ‹workspace›". Your plan's member limit applies: when the workspace is full, the sign-in says so and nothing is created.Without it, people need an invitation from an Owner first.Your directory (SCIM 2.0)Your directory can add and remove people for you. We give you a SCIM base URL and a token:

Setting

Value

SCIM base URL

https://mirage-api.ingevora.com/scim/v2

Authentication

HTTP header Authorization: Bearer <token>

The token is shown once. Keep it in your identity provider only. We can replace or revoke it at any time; the old one stops working at once.

Users only, no groups. userName is the person's work email on your domains.

Create adds the person to your workspace with the role for new people, and creates their account if they have none (with the same welcome email).

Deactivate (active: false) or delete removes the person from your workspace. Their account stays, with anything else it belongs to. The last Owner of a workspace is never removed.

Your directory sees only the members on your domains. People outside them, such as an agency, are managed by your workspace's Owners.

Find a person with filter=userName eq "pat@example.com". PATCH supports active and the name.

Each token may make 300 requests a minute.

Errors use the SCIM error format, for example 409 when the person is already in the workspace or the plan's member limit is reached.Related pages

Workspaces and roles — roles, invitations and the workspace's sign-in rules.

Getting started — your first lens, from sign-in to your first request.