Skip to main content

Single Sign-On

Single Sign-On lets your team sign in to NeoSpace with your organization's existing identity provider, so accounts are created, authenticated and deactivated where you already manage them.

Configure it under Settings → Single Sign-On. The screen has two halves: the identity provider your team signs in through, and SCIM tokens for automatic user provisioning. Both require an administrator seat.

Identity provider​

NeoSpace connects to any OIDC-compliant identity provider. One provider is configured per organization.

FieldWhat it is
Display NameThe label users see on the sign-in button, e.g. Corporate SSO.
SlugA URL-safe identifier for the provider, e.g. corporate-sso. Used in the callback URL.
Issuer URLYour provider's OIDC issuer. NeoSpace reads its discovery document from here.
Client IDThe OAuth2 client ID registered for NeoSpace in your provider.
Client SecretThe matching secret. When editing, leaving it blank keeps the current one.
ScopesSpace-separated scopes to request. openid profile email covers the standard case.

For the full walkthrough — registering the application on the provider side, the redirect URI to configure, claim mapping and troubleshooting — see the OIDC setup guide.

Deleting a provider locks out its users

Removing the provider means nobody can sign in through it any more. The action asks you to type the provider's name to confirm, and cannot be undone. To rotate credentials, edit the provider instead.

SCIM provisioning​

SCIM keeps NeoSpace in sync with your directory: users your identity provider creates, updates or deactivates are reflected here without anyone inviting them by hand.

SCIM has no separate on/off switch — it is enabled by generating its first token, and stays enabled while at least one active token exists. Revoking every token disables it.

Working with tokens:

  • Generate issues a token and shows it once. Copy it immediately; it is never displayed again. A token may have an expiry date or never expire.
  • Regenerate issues a replacement and keeps SCIM configured. This is what you want for routine secret rotation.
  • Revoke invalidates a token. Revoking the last one turns SCIM off.

A provider can hold only one active token at a time; generating a second fails.

How this relates to seats​

SSO decides who can sign in. It does not decide what they can do — that is seats and permissions, granted per Space. A user provisioned through SCIM can authenticate but sees nothing until they hold a seat.

Next steps​