VeritomeHelp Centre
/
Browse the guides
Integrations

Set up SSO and SCIM provisioning

Connect your identity provider over OIDC for single sign-on, and mint SCIM tokens so your IdP provisions and deactivates users automatically — both Enterprise features, configured by an Admin.

Updated Veritome documentation

Both features live under Organisation → SSO & SCIM and can only be configured by an organisation Admin. Single sign-on and SCIM provisioning are Enterprise features: on other plans the section shows what it does and stays read-only.

Single sign-on (OIDC)

Veritome supports OIDC single sign-on with providers such as Okta, Azure AD (Entra ID) or Google Workspace. SAML is not supported today.

  1. In your IdP, create an OIDC application and register the Redirect / callback URL shown at the top of the SSO section.
  2. In Veritome, enter the Issuer URL (must be https — the issuer is checked when you save, so a bad issuer is caught before the connection is enabled), the Client ID and the Client secret. The secret is stored AES-256-GCM encrypted and is never shown again; leave the field blank on later edits to keep the current one.
  3. Add Allowed email domains (one per line). Members whose email domain matches can sign in via SSO. By default password sign-in also stays available, protected by two-factor authentication from each person's second sign-in (switch on Require two-factor from the first sign-in under Organisation → Security to close the first) — or, once the connection is on, tick Require SSO for allowed domains. With it on, everyone whose email domain is in the list — Admins included — must sign in through your identity provider: password sign-in, emailed sign-in links and Google or Microsoft sign-in are refused with a message pointing them to Sign in with SSO, so a stolen password no longer gets round your IdP and its MFA. The break-glass is deliberate and separate: on the login page, Administrator sign-in without SSO lets an organisation Admin sign in with their password, so an outage at your identity provider cannot lock the organisation out. Two-factor authentication still applies, every such sign-in is written to the audit log, and for anyone who is not an Admin it fails exactly like a wrong password (and counts towards the lockout like one). Keep at least one admin with a strong password and two-factor authentication. The setting is off by default, can only be switched on while the connection is on and lists at least one domain, is switched off again if you turn the connection off, and every change is written to the audit log.
  4. Auto-provision is on by default, so a first SSO sign-in from an allowed domain creates the member; untick it to admit only people who already have an account in this workspace. Pick the role new SSO users get — Viewer by default, or Compliance manager or Admin.
  5. Turn the connection on. It is disabled by default, so configuring it can never disrupt existing logins.

SCIM provisioning

The SCIM section shows your SCIM 2.0 base URL (the /api/scim/v2 endpoint, with Users, Groups and ServiceProviderConfig resources). To connect your IdP:

  1. Create a SCIM token. The full token (starting with scim_) is shown exactly once — only its SHA-256 hash is stored, so copy it immediately.
  2. In your IdP, configure SCIM with the base URL and the token as the bearer token.
  3. When the IdP deactivates a user, their Veritome access is revoked.

Revoke tokens any time from the same section; every change is written to the audit log. Multi-factor authentication for password sign-in is separate and lives under Organisation → Security.