Single Sign-On (SAML)
Connect Microsoft Entra ID, Okta, or another SAML 2.0 identity provider so your team signs in to CLEATUS with their work accounts.
Single sign-on (SSO) lets your team sign in to CLEATUS through your identity provider (IdP), such as Microsoft Entra ID or Okta. Each company in your organization sets up its own connection. The first time a person on the company's email domain signs in, CLEATUS adds them to that company. This guide shows you how to connect your IdP, verify your domain, and require SSO.
Before you start:
SSO is available to a company on the DATA + AI + Automations plan and higher. The organization Owner can set it up, or an Admin who is a member of the company. You also need administrator access to your IdP and to the DNS records of your email domain.
How sign-in works
- A person enters their work email on the CLEATUS sign-in page and clicks Continue with SSO. CLEATUS sends them to your IdP.
- People can also open CLEATUS from the app tile in your IdP.
- The first time a person signs in, CLEATUS adds them to the company, with the role that you choose. Each new person takes a seat, including a person who already belongs to another company in your organization. When the company has no free seat, CLEATUS refuses the sign-in and shows a message. Add a seat in Billing, then the person signs in again.
- A person who already belongs to your organization keeps their current role.
- Each email domain belongs to one company. Several companies can use the same IdP if each one has its own domain.
Set up single sign-on
Open the Single Sign-On settings
Open the company, then in the sidebar click Settings, then Single Sign-On. The page applies to the company that is open. Step 1 on the page shows two values, the Entity ID and the ACS URL (Assertion Consumer Service URL), and a Metadata file that you can download. After you save the connection, step 1 also shows a Metadata URL.
Create a SAML application in your identity provider
Create a new SAML 2.0 application, and copy the values from step 1 into it.
- Microsoft Entra ID: go to Enterprise applications, click New application, then Create your own application. In Single sign-on, select SAML. In Basic SAML Configuration, paste the Entity ID into Identifier (Entity ID) and the ACS URL into Reply URL (Assertion Consumer Service URL). Or click Upload metadata file and select the metadata file from step 1: Entra ID fills both values for you.
- Google Workspace: in the Admin console, go to Apps > Web and mobile apps, click Add app, then Add custom SAML app. On the Google Identity Provider details page, click Download metadata and keep the file for later. On the Service provider details page, paste the ACS URL into ACS URL and the Entity ID into Entity ID.
- Okta: go to Applications, click Create App Integration, and select SAML 2.0. Paste the ACS URL into Single sign-on URL, and the Entity ID into Audience URI (SP Entity ID).
Send the email address as the Name ID, with the format EmailAddress. To show names in CLEATUS, also send the
attributes email, givenName, and surname.
Assign people to the application
In your IdP, assign the users or groups that may sign in to CLEATUS.
Add the IdP metadata to CLEATUS
Download the federation metadata XML from your IdP. In Entra ID it is Federation Metadata XML in the SAML Certificates section. In Okta it is the Metadata URL on the Sign On tab: open the URL and copy the XML. In Google Workspace it is the file from Download metadata. In CLEATUS, click Continue at the bottom of step 1 to open step 2. In step 2:
- Enter your email domain, such as
example.com. - Paste the metadata XML, or click Upload XML file. If your IdP gives no metadata XML, click Enter fields by hand and enter the Single sign-on URL, the Identity provider entity ID, and the Signing certificate. Google Workspace calls these SSO URL, Entity ID, and Certificate. Okta shows them under View SAML setup instructions.
- Choose the role new people get: Member, Restricted Member, or Admin. They join the company that is open.
- Click Save and continue. Step 3 opens.
Verify your domain
Step 3 shows a TXT record name and value. Add the TXT record at your DNS provider, then click Verify domain. DNS changes can take a few minutes to appear. People can sign in with SSO after the domain is verified.
Require single sign-on
When Require SSO is on, everyone with an address on your domain can sign in only through your IdP. Passwords, email codes, Google sign-in, and passkeys stop working for them. To turn it on, verify your domain first, then turn on Require SSO in step 4.
Removing access:
Removing a person from the application in your IdP stops new sign-ins. To remove their access to CLEATUS right away, also remove them in Users and Teams.
Troubleshooting
| Message | What to do |
|---|---|
| Your company has no free seats | Add a seat in Billing, then sign in again. |
| Sign in with an address on your company's single sign-on domain | The IdP sent an email address that is not on the verified domain. Check the Name ID or the email attribute in your IdP. |
| Single sign-on is not available for your company right now | The domain is not verified, or the company is no longer on an eligible plan. Check Settings > Single Sign-On. |
| Your company's subscription is not active | The company's subscription has lapsed. The account owner renews it in Billing. |
| Your company requires single sign-on | Require SSO is on for your domain, so passwords, email codes, and passkeys are refused. Click Continue with SSO. |
| You entered (one address), but your identity provider signed you in as (another address) | Your IdP still has a session for someone else. Sign out of your IdP, then sign in to CLEATUS again. |
| Single sign-on did not complete | The IdP response failed validation. Check that the ACS URL and the Entity ID match step 1, and that the signing certificate in the saved metadata is current. |
Remove single sign-on
Below step 4, next to Remove single sign-on, click Remove. Then click Remove again to confirm. Members keep their accounts. They sign in with a password, an email code, or a passkey.