Enterprise SSO
Single Sign-On (SSO) allows your organization to use your existing identity provider to authenticate users in Ledly. This provides centralized access control, improved security, and a seamless login experience for your team.
Enterprise SSO is available on the Enterprise plan ($1,999/mo). Contact [email protected] to upgrade.
Supported Identity Providers
Ledly supports the following identity providers:
Enterprise-grade identity management with SAML 2.0
Okta (SAML 2.0)Microsoft Entra ID integration via OpenID Connect
Azure AD (OIDC)Google Workspace authentication via OAuth 2.0
Google Workspace (OAuth 2.0)Auth0 integration via OpenID Connect
Auth0 (OIDC)Key Features
Organization-Level Configuration
SSO is configured per-organization, allowing different departments or institutions to use different identity providers while sharing the same Ledly platform.
Just-In-Time (JIT) Provisioning
When a user authenticates via SSO for the first time, Ledly automatically creates their account. This eliminates the need for manual user provisioning and ensures users can start working immediately.
JIT provisioning includes:
- Automatic account creation on first SSO login
- Email-based account linking (SSO accounts are linked to existing Ledly accounts if the email matches)
- Configurable default role assignment (member or admin)
Account Linking
If a user already has a Ledly account with the same email address, their SSO identity is automatically linked to the existing account. This ensures:
- Continuity of data and permissions
- No duplicate accounts
- Seamless transition from password-based to SSO authentication
Flexible Authentication
SSO doesn’t have to be all-or-nothing. You can configure whether password login remains available as a fallback option for users who can’t access the identity provider.
How SSO Works
User → Ledly Login → Redirect to IdP → IdP Authentication → Callback to Ledly → Session CreatedUser initiates login
The user visits Ledly and clicks “Sign in with SSO” or enters their email address.
Redirect to Identity Provider
Ledly redirects the user to your configured identity provider (Okta, Azure AD, etc.).
User authenticates
The user authenticates with their corporate credentials at the identity provider.
Callback to Ledly
After successful authentication, the IdP redirects back to Ledly with an authentication assertion.
Session created
Ledly validates the assertion, creates or links the user account, and starts a session.
SSO Settings
Configure SSO in Settings → SSO within your Ledly organization.
Available Options
| Setting | Description | Default |
|---|---|---|
| Identity Provider | Select your SSO provider (Okta, Azure AD, Google, Auth0) | None |
| Auto-provision users | Automatically create accounts for new SSO users | Enabled |
| Default role | Role assigned to auto-provisioned users | Member |
| Allow password login | Whether to allow password login alongside SSO | Enabled |
Configuration Fields
Each identity provider requires different configuration fields:
| Provider | Required Fields |
|---|---|
| Okta (SAML 2.0) | Issuer URL, SSO URL, IdP Certificate |
| Azure AD (OIDC) | Tenant ID, Client ID, Client Secret |
| Google Workspace | Client ID, Client Secret |
| Auth0 (OIDC) | Domain, Client ID, Client Secret |
Security Considerations
Protocol Security
| Protocol | Used By | Security Features |
|---|---|---|
| SAML 2.0 | Okta | XML signatures, encrypted assertions, replay protection |
| OIDC | Azure AD, Auth0 | JWT tokens, PKCE, state parameter validation |
| OAuth 2.0 | Google Workspace | PKCE, state parameter validation, refresh tokens |
Best Practices
- Use HTTPS everywhere - All SSO callback URLs use HTTPS
- Validate tokens - Ledly validates all IdP responses cryptographically
- Limit session duration - Configure session timeouts in both Ledly and your IdP
- Monitor SSO events - Review authentication logs for unusual activity
- Test before rollout - Test SSO with a small group before org-wide deployment
Compliance
SSO helps meet compliance requirements:
- SOC 2 - Centralized access control
- GDPR - Right to be forgotten (deactivate IdP account)
- FERPA - Student data access controls
- NIST - Multi-factor authentication when enforced at IdP
Troubleshooting
Common Issues
| Issue | Possible Cause | Solution |
|---|---|---|
| Redirect loop | Misconfigured callback URL | Verify callback URL matches exactly |
| User not found | JIT provisioning disabled | Enable auto-provisioning or pre-create user |
| Email mismatch | IdP email differs from Ledly email | Ensure email attributes match |
| Certificate error | Expired or wrong IdP certificate | Update certificate in Ledly SSO settings |
Getting Help
If you encounter SSO issues:
- Check your IdP’s authentication logs for errors
- Verify all configuration values are correct
- Contact [email protected] with:
- Your organization ID
- The identity provider you’re using
- Any error messages displayed
Setup Guides
Select your identity provider to get started: