SSO setup

How SAML SSO works

Sign-in is routed by email domain: once SAML is configured and your domain is verified, anyone entering an email like alex@yourcompany.com on the login page is redirected to your IdP. Users are provisioned just-in-time on first login — no manual invitations needed for SSO users.

Configuring SAML

You’ll need an Owner or Admin role in StaleSweep and admin access to your IdP.

1. Go to Settings → SSO / SAML. For security, this page requires a fresh re-authentication.
2. Register StaleSweep in your IdP as a SAML 2.0 application. StaleSweep provides its Service Provider details on the setup page, including the SP metadata XML — most IdPs accept the metadata file directly. (Okta: Applications → Create App Integration → SAML 2.0. Entra ID: Enterprise applications → New application → Create your own → SAML. Google Workspace: Apps → Web and mobile apps → Add custom SAML app.)
3. Copy your IdP’s details into StaleSweep — either upload the IdP metadata XML, or fill in the IdP Entity ID, IdP SSO URL, and IdP X.509 signing certificate.
4. Set your email domain (e.g. yourcompany.com). Only emails at this domain can sign in through the connection, and each domain can be claimed by exactly one StaleSweep workspace. SSO is active as soon as you save.
5. Test: sign out, enter a company email on the login page, and confirm you’re redirected to your IdP and back.

Okta (step by step)

Do this in the Okta Admin console.

1. Go to Applications → Applications → Create App Integration, choose SAML 2.0, and name it StaleSweep.
2. On Configure SAML, set Single sign-on URL to the ACS URL and Audience URI (SP Entity ID) to the Audience URI shown in StaleSweep’s setup panel. Set Name ID format to EmailAddress and Application username to Email.
3. Under Attribute Statements, map firstName → user.firstName and lastName → user.lastName. To drive admin access by group, add a Group Attribute Statement named groups with a filter matching the groups you want to send, and list those group names as admin groups in StaleSweep.
4. Finish, then on the app’s Sign On tab, download the Identity Provider metadata (or copy the Identity Provider Issuer, IdP SSO URL, and X.509 Certificate). Upload the metadata XML on StaleSweep’s SSO setup page, or fill the three IdP fields manually.
5. On the Assignments tab, assign the people or groups who should be able to sign in.

Microsoft Entra ID (step by step)

Do this in the Microsoft Entra admin center.

1. Go to Enterprise applications → New application → Create your own application, name it StaleSweep, and choose Integrate any other application you don’t find in the gallery.
2. Open Single sign-on → SAML and edit Basic SAML Configuration: set Identifier (Entity ID) to the Audience URI and Reply URL (ACS URL) to the ACS URL shown in StaleSweep’s setup panel.
3. Under Attributes & Claims, set the Unique User Identifier (Name ID) to user.mail, and add claims for firstName → user.givenname and lastName → user.surname. To drive admin access by group, add a groups claim and list those group names as admin groups in StaleSweep.
4. Under SAML Certificates, download the Federation Metadata XML and upload it on StaleSweep’s SSO setup page (or copy the Login URL, Microsoft Entra Identifier, and the certificate, and fill the three IdP fields manually).
5. On the Users and groups tab, assign the people or groups who should be able to sign in.

Google Workspace (step by step)

Google Workspace doesn’t accept a metadata file for custom SAML apps, so you’ll copy a few fields by hand. Do this in the Google Admin console as a super admin.

1. Go to Apps → Web and mobile apps → Add app → Add custom SAML app. Name it StaleSweep and continue.
2. On the Google Identity Provider details screen, click Download Metadata (or copy the SSO URL, Entity ID, and Certificate). This is what you paste back into StaleSweep — upload the metadata XML on the SSO setup page, or fill the three IdP fields manually.
3. On the Service Provider details screen, set ACS URL and Entity ID to the ACS URL and Audience URI shown in StaleSweep’s setup panel. Set Name ID format to EMAIL and Name ID to Basic Information → Primary email.
4. On Attribute mapping, map First name → firstName, Last name → lastName. To drive admin access by group, add a Group membership mapping to groups and list those group names as admin groups in StaleSweep.
5. Finish, then turn the app ON for everyone (or the right organizational units) under User access. Changes can take a few minutes to take effect.

SSO and roles

Two settings control what SSO users get: the default role assigned to new users provisioned through SSO (recommended: member), and admin group names — if your IdP sends group claims, users in any of these groups are granted admin automatically at login. Existing users signing in via SSO for the first time are linked by email and keep their role.

Automatic provisioning with SCIM

SAML provisions a user just-in-time on their first login. SCIM goes further: your identity provider pushes user changes to StaleSweep as they happen, so members are created ahead of time and — most importantly — de-provisioned automatically. When someone is removed or deactivated in your directory, their StaleSweep membership is removed and their active sessions are revoked immediately, rather than lingering until a token expires. SCIM is a Business-plan feature and is admin-only to configure.

1 · Enable SCIM in StaleSweep

1. Go to Settings → Integrations → User provisioning (SCIM) and click Enable SCIM. For security, issuing a token requires a fresh re-authentication.
2. Copy the SCIM base URL (it ends in /api/scim/v2) and the bearer token. The token is shown once — store it in your IdP now. You can rotate or disable it here at any time.

2 · Okta

1. In your SCIM-enabled Okta app, open Provisioning → Integration → Configure API Integration and check Enable API integration.
2. Set SCIM connector base URL to the base URL above, Unique identifier field to userName, and Authentication Mode to HTTP Header with the bearer token. Click Test API Credentials, then Save.
3. Under Provisioning → To App, enable Create Users, Update User Attributes, and Deactivate Users, then assign people or groups to the app.

3 · Microsoft Entra ID

1. Open Enterprise applications → your app → Provisioning and set Provisioning Mode to Automatic.
2. Under Admin Credentials, set Tenant URL to the base URL and Secret Token to the bearer token, then Test Connection and Save.
3. Choose a provisioning Scope, assign users or groups, and switch Provisioning Status to On. Entra syncs on its own schedule (roughly every 40 minutes).