SSO & SCIM

How sign-in works

Whatever the method, a successful sign-in ends in the same Veqsio session as a password login. Open Administration → Security: Single sign-on (Microsoft), OpenID Connect, SAML single sign-on, LDAP / Active Directory and SCIM provisioning. When any single sign-on method is enabled, the login page shows its button (for example Sign in with Microsoft) under the password form.

OpenID Connect

1. At your identity provider (Okta, Keycloak, Google, Entra…) register an application and set the redirect address shown on Veqsio’s OIDC page; it looks like https://your-host/rest/auth/1/oidc/<slug>/callback.
2. In Veqsio open OpenID Connect and add a provider: a display name, the Slug (cannot be changed later), the Issuer URL (https; discovery is read from /.well-known/openid-configuration), the Client ID and the client secret, Scopes (must include openid) and the claims to read for e-mail, name and groups. The secret is stored encrypted.
3. Decide the behaviour: auto-provision (create accounts on first login, optionally only for listed e-mail domains), link by e-mail (attach the identity to an existing local account — only if the provider says the address is verified), and group sync (a claim whose values become Veqsio groups).
4. Test with a normal user in a private window before turning on enforcement.

Sign-in is protected against forged and replayed responses (state, nonce and PKCE), the identity provider’s signature is checked, and the return address must stay on your site.

Enforce SSO

With Enforce SSO on, password login is refused for everyone except system administrators, so a broken identity provider can never lock you out. Keep at least one local administrator.

SAML 2.0

Works with Entra ID, Okta, ADFS, Keycloak, Google Workspace or any SAML 2.0 provider (sign-in starts at Veqsio). Open SAML single sign-on:

1. Add a provider with a Slug (cannot be changed later). The page then shows Give these values to your identity provider: the Entity ID (audience), the ACS URL (POST) and the SP metadata.
2. Enter the provider’s IdP entity ID (issuer), its single sign-on URL (HTTP-Redirect) and its signing certificate(s) in PEM form. Paste the next certificate too before a key rollover.
3. Set the attribute mapping: e-mail, username, display name and groups attributes, and the NameID format.
4. Options: Create accounts on first sign-in (JIT provisioning), Link existing accounts by email, Synchronise groups, Default groups for new users, Allowed email domains, signing of authentication requests, and Enforce SSO for these domains.
5. Press Check configuration, then Enabled.

LDAP / Active Directory

Open LDAP / Active Directory and add a directory (Use Active Directory defaults fills typical values):

• Connection — server URL, Use StartTLS, Verify the server certificate, timeout, and the service account bind DN and password.
• Users — user base DN, user filter, and the attributes for username, e-mail, display name and a stable unique ID.
• Groups (optional) — group base DN (empty means no group sync), group filter, group name and membership attributes, and Resolve nested groups.
• Behaviour — Allow password sign-in with directory credentials, Create accounts for directory users, Link existing accounts by email, Deactivate users that disappeared from the directory, and Scheduled sync with an interval in minutes.

Test the connection and a sync with a narrow filter first, then widen it.

SCIM provisioning

SCIM lets your identity provider create, update and deactivate users and groups automatically.

1. Open SCIM provisioning and create a token. It is shown once; store it in the provider’s secret store.
2. In your provider add a SCIM application with the base address https://your-host/scim/v2 and that token.
3. Assign people and groups to the application. They appear in Veqsio; removing them from the application, or marking them inactive, deactivates the account (nothing is deleted) and ends their sessions and tokens immediately.

Access tokens for scripts

Scripts do not use SSO; they use personal access tokens (Profile → Access tokens). Tokens always expire (90 days by default, at most 365) and carry scopes — read:*, write:*, read:issues, write:issues, read:projects, write:projects, or */admin for administrator-level APIs. A limited token can never create a stronger one. Deactivating a user revokes their tokens.

A safe order of setup

1. Keep a local administrator account with a strong password.
2. Configure the provider and test sign-in with a second account.
3. Enable provisioning or group sync and check the groups it creates.
4. Only then switch on Enforce SSO.
5. Add a calendar reminder to rotate the SCIM token and the OIDC client secret.

The OIDC and SCIM flows are tested against simulated providers; run a smoke test against your real provider before relying on them in production.