Identity & SSO

Slim.io supports SAML 2.0 Single Sign-On (SSO) to integrate with your organization’s identity provider. When SSO is configured, users authenticate through your IdP instead of managing separate Slim.io credentials.

Supported Identity Providers

Provider	Protocol	Status
Microsoft Entra ID (Azure AD)	SAML 2.0	Fully supported
Okta	SAML 2.0	Fully supported
Google Workspace	SAML 2.0	Fully supported
Custom SAML	SAML 2.0	Any compliant IdP

SAML Configuration

Slim.io Service Provider (SP) Details

When configuring your IdP, use these SP values:

Field	Value
Entity ID	`https://slim.io/saml/metadata`
ACS URL	`https://slim.io/saml/acs`
SLO URL	`https://slim.io/saml/slo` (optional)
NameID Format	`urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`

Required SAML Attributes

Your IdP must release the following attributes in the SAML assertion:

Attribute	Required	Description
`email`	Yes	User’s email address (used as the primary identifier)
`firstName`	No	User’s first name (for display)
`lastName`	No	User’s last name (for display)
`groups`	No	Group memberships (for role mapping)

Setup: Microsoft Entra ID

In the Azure Portal, navigate to Enterprise Applications > New Application > Create your own application.
Select Integrate any other application you don’t find in the gallery (Non-gallery).
Name the application (e.g., “Slim.io”).
Go to Single sign-on > SAML.
Set the Identifier (Entity ID) to https://slim.io/saml/metadata.
Set the Reply URL (ACS URL) to https://slim.io/saml/acs.
Under Attributes & Claims, ensure email is mapped to user.mail.
Download the Federation Metadata XML or copy the Login URL, Identifier, and Certificate values.
In Slim.io, navigate to Settings > Identity > Add Connection.
Select Entra ID and paste the metadata or individual values.
Click Test Connection and complete the SAML flow.
Click Activate.

Setup: Okta

In the Okta Admin Console, navigate to Applications > Create App Integration.
Select SAML 2.0.
Enter the Single sign on URL: https://slim.io/saml/acs.
Enter the Audience URI (SP Entity ID): https://slim.io/saml/metadata.
Set Name ID format to EmailAddress.
Add attribute statements for email, firstName, lastName.
Complete the wizard and copy the Identity Provider metadata URL.
In Slim.io, select Okta as the provider and enter the metadata URL.
Test and activate.

Setup: Google Workspace

In the Google Admin Console, navigate to Apps > Web and mobile apps > Add App > Add custom SAML app.
Enter the ACS URL: https://slim.io/saml/acs.
Enter the Entity ID: https://slim.io/saml/metadata.
Set Name ID format to EMAIL.
Map attributes: email to Primary Email.
Download the IdP metadata.
In Slim.io, select Google Workspace and upload the metadata.
Test and activate.

Just-In-Time (JIT) Provisioning

When JIT provisioning is enabled:

Users who authenticate via SSO for the first time are automatically created in Slim.io
New users receive the Viewer role by default
Users are assigned to the Default workspace
Administrators can promote users and assign additional workspaces after first login

JIT provisioning eliminates the need to manually create user accounts before they can access Slim.io. It is enabled by default when SSO is activated.

Group-Based Role Mapping

If your IdP releases a groups attribute, you can map IdP groups to Slim.io roles:

IdP Group	Slim.io Role	Workspace
`slim-io-admins`	Admin	All workspaces
`slim-io-editors`	Editor	Default workspace
`slim-io-viewers`	Viewer	Default workspace

Configure group mappings in Settings > Identity > Role Mapping.

Enforcing SSO

When SSO is activated with enforcement:

All users must authenticate through the configured IdP
Email/password login is disabled for non-admin accounts
At least one account retains email/password access as a recovery mechanism
API keys continue to work independently of SSO enforcement

Before enforcing SSO, verify that: (1) at least one admin has recovery access, (2) the IdP SAML configuration is tested and working, and (3) all active users have accounts in the IdP.