SAML 2.0 SSO
SAML 2.0 SSO is available on Team, Business, and Enterprise plans. Connect your identity provider (IdP) so members sign in with their organizational credentials.Supported Identity Providers
- Okta
- Microsoft Azure Active Directory (Entra ID)
- Google Workspace
- OneLogin
- Ping Identity
- Any SAML 2.0-compliant IdP
Setup
Step 1: Start SAML Configuration in MergeGuide
- Go to Settings > Security > Single Sign-On
- Click Configure SAML
- Download the MergeGuide Service Provider (SP) metadata file
- Entity ID:
https://portal.mergeguide.ai/saml/metadata - ACS URL:
https://portal.mergeguide.ai/saml/acs - Certificate for signature verification
Step 2: Configure Your IdP
Using the SP metadata, create a new application/integration in your IdP. Required attribute mappings:| SAML Attribute | MergeGuide Field |
|---|---|
email or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress | Email (required) |
firstName or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname | First name |
lastName or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname | Last name |
| IdP Group Attribute | MergeGuide Role |
|---|---|
mergeguide_admin | Admin |
mergeguide_developer | Developer |
mergeguide_viewer | Viewer |
Step 3: Complete Configuration in MergeGuide
- Copy the IdP metadata URL or upload the IdP metadata XML
- Enter the IdP Entity ID
- Enter the SSO URL (SAML endpoint from your IdP)
- Upload or paste the IdP signing certificate
- Click Save Configuration
Step 4: Test the Connection
- Click Test SSO — this opens a test login in a new window without affecting your current session
- Complete the IdP authentication flow
- Verify the test user attributes are parsed correctly
- Click Enable SSO
Enforcement Options
Once SSO is enabled, choose an enforcement level:| Mode | Behavior |
|---|---|
| Optional | Members can sign in with SSO or email/password |
| Required | All members must use SSO; email/password login is disabled |
Just-in-Time Provisioning
When a user signs in via SAML for the first time, MergeGuide automatically creates their account. The user is assigned the default role (Viewer) unless your IdP sends role attributes. To disable JIT provisioning and require manual account creation, contact support.SCIM Integration
For automatic user lifecycle management (provisioning, de-provisioning, group sync), configure SCIM v2 alongside SAML. See SCIM Provisioning.Troubleshooting
”SAML Response Invalid”
- Verify the ACS URL in your IdP matches
https://portal.mergeguide.ai/saml/acs - Check that the IdP certificate hasn’t expired
- Confirm time synchronization between IdP and MergeGuide (SAML assertions expire quickly)
“User Not Provisioned”
- Verify the email attribute is mapped in your IdP configuration
- Check that the email domain matches your organization’s registered domain
- If JIT provisioning is disabled, create the user manually first