Skip to main content
Enclave is IdP-agnostic — any standards-compliant OpenID Connect or SAML 2.0 provider works (Ping, ADFS, Auth0, Keycloak, OneLogin, JumpCloud, …). This page gives the generic mappings; for named providers see Okta, Entra ID, or Google Workspace.
Where: Organization → Single Sign-On in Enclave (Owner role). One email domain maps to one connection.

​
OIDC

1

Register a Web application at your IdP

  • Redirect URI: https://<your-enclave-host>/api/auth/oidc/callback
  • Scopes: openid, profile, email
  • Note the Client ID and Client Secret.
2

Add the connection in Enclave

Add Connection → OIDC → Custom:
Enclave resolves the user’s email from email, falling back to preferred_username then upn (both must contain @). Ensure your IdP releases one of these in the ID token.

​
SAML 2.0 — the generic field mapping

SAML config is entered field-by-field. The two mappings that trip people up: a URL is not an Entity ID, on both sides.
Two mirror-image gotchas: at your IdP, use the entityID value (not its metadata URL) for IdP Entity ID / Issuer; at Enclave’s SP side, the Audience your IdP must send is the per-connection metadata URL (with the connection id), shown on the connection card. Both are shown/derivable from the connection card and the IdP’s metadata.

​
Signing & format

  • Sign the assertion (or response) with RSA-SHA256 / SHA256 digest.
  • Do not encrypt the assertion (unencrypted only).
  • NameID: emailAddress works for most IdPs; if yours rejects it (some ADFS/Entra setups), set the connection’s NameID Format to Persistent or Unspecified.
  • SP certificate: generate it one-click on the connection card, then import the per-connection SP metadata URL at your IdP.
  • Multiple concatenated PEM certs are accepted in the certificate field to cover IdP signing-key rotation.

​
Shared steps & troubleshooting

Domain verification, SP-certificate generation, provisioning mode, Require-fresh-sign-in, and Single Logout are the same for every IdP — see Authentication. The troubleshooting table (audience / issuer / signature / timing / InResponseTo reasons) is provider-agnostic.