SSO and SCIM
Blank supports SAML 2.0 single sign-on and SCIM provisioning. SSO is configured in Settings → Single sign-on (SAML).
How membership works
- Domain auto-join. A SAML login whose email domain matches your configured domain auto-joins your organization at the default role you set (default: viewer).
- SCIM overrides the role. If your identity provider has pushed a roster entry for that user (say, provisioned as an admin), that role wins.
To sign in, the user types their work email and clicks Sign in with SSO. Blank resolves the provider by domain and redirects to your IdP. Launching from the IdP's app tile works too.
Service-provider details
Give these to your IdP. They're shown in Settings → Single sign-on (SAML).
| Field | Value |
|---|---|
| ACS / Reply URL | https://<project>.supabase.co/auth/v1/sso/saml/acs |
| Entity ID / Audience | https://<project>.supabase.co/auth/v1/sso/saml/metadata |
The assertion must send the email as the NameID. The account and domain auto-join are keyed on it.
Okta
- Okta Admin → Applications → Create App Integration → SAML 2.0.
- Set Single sign-on URL to the ACS URL, and Audience URI to the Entity ID.
- Set Name ID format to
EmailAddress, and map the application username to the user's email. - Assign the app to the users and groups who should have access.
- Copy Okta's Identity Provider metadata URL (App → Sign On).
- In Blank, enter your email domain, paste the metadata URL, pick the default role, and Configure SSO.
Microsoft Entra ID
- Entra admin → Enterprise applications → New application → Create your own (non-gallery).
- Under Single sign-on → SAML, set Identifier (Entity ID) and Reply URL (ACS) from the table above.
- Under Attributes & Claims, set the email from
user.userprincipalnamein both the Name ID (format: Email address) and the email-address claim. Don't leave these onuser.mail. A bare*.onmicrosoft.comtenant has no mailbox, souser.mailis empty and the login is rejected. The UPN is the only email-shaped value. - Set Basic SAML Configuration → Relay State to your dashboard URL (
https://useblank.dev/admin/). This is where an IdP-initiated login lands. - Assign users and groups, then copy the App Federation Metadata URL.
- In Blank, enter the email domain (for
*.onmicrosoft.comusers that's<tenant>.onmicrosoft.com), paste the metadata URL, pick the default role, and Configure SSO.
Deprovisioning
Remove a user's app assignment, or push SCIM active:false, and their access is gone on their next request. Blank re-checks membership on every request, so revocation is effectively immediate.