# SSO and SCIM

Blank supports SAML 2.0 single sign-on and SCIM provisioning. SSO is configured in **Settings → Single sign-on (SAML)**.

## How membership works

- **Domain auto-join.** A SAML login whose email domain matches your configured domain auto-joins your organization at the **default role** you set (default: viewer).
- **SCIM overrides the role.** If your identity provider has pushed a roster entry for that user (say, provisioned as an admin), that role wins.

To sign in, the user types their work email and clicks **Sign in with SSO**. Blank resolves the provider by domain and redirects to your IdP. Launching from the IdP's app tile works too.

## Service-provider details

Give these to your IdP. They're shown in **Settings → Single sign-on (SAML)**.

| Field | Value |
|---|---|
| ACS / Reply URL | `https://<project>.supabase.co/auth/v1/sso/saml/acs` |
| Entity ID / Audience | `https://<project>.supabase.co/auth/v1/sso/saml/metadata` |

The assertion must send the email as the NameID. The account and domain auto-join are keyed on it.

## Okta

1. Okta Admin → **Applications → Create App Integration → SAML 2.0**.
2. Set **Single sign-on URL** to the ACS URL, and **Audience URI** to the Entity ID.
3. Set **Name ID format** to `EmailAddress`, and map the application username to the user's email.
4. Assign the app to the users and groups who should have access.
5. Copy Okta's **Identity Provider metadata URL** (App → Sign On).
6. In Blank, enter your **email domain**, paste the **metadata URL**, pick the **default role**, and **Configure SSO**.

## Microsoft Entra ID

1. Entra admin → **Enterprise applications → New application → Create your own** (non-gallery).
2. Under **Single sign-on → SAML**, set **Identifier (Entity ID)** and **Reply URL (ACS)** from the table above.
3. Under **Attributes & Claims**, set the email from **`user.userprincipalname`** in **both** the **Name ID** (format: Email address) **and** the email-address claim. Don't leave these on `user.mail`. A bare `*.onmicrosoft.com` tenant has no mailbox, so `user.mail` is empty and the login is rejected. The UPN is the only email-shaped value.
4. Set **Basic SAML Configuration → Relay State** to your dashboard URL (`https://useblank.dev/admin/`). This is where an IdP-initiated login lands.
5. Assign users and groups, then copy the **App Federation Metadata URL**.
6. In Blank, enter the **email domain** (for `*.onmicrosoft.com` users that's `<tenant>.onmicrosoft.com`), paste the metadata URL, pick the **default role**, and **Configure SSO**.

## Deprovisioning

Remove a user's app assignment, or push SCIM `active:false`, and their access is gone on their next request. Blank re-checks membership on every request, so revocation is effectively immediate.