Set up single sign-on (SAML)

Single sign-on (SSO) lets people with your company email sign in to SwfTap through your identity provider instead of a SwfTap password. It's included in the Team and Enterprise plans, and only an Admin of the organisation can set it up, under Settings > Team > Single sign-on.

1. Verify your domain

Enter your company's email domain (for example acme.com.au) and select Continue. SwfTap shows a TXT record: add it at your DNS provider with the name _swftap-challenge.<your domain> and the value starting swftap-verification=, then select Verify domain. DNS changes can take a few minutes to appear. Public email domains such as gmail.com can't be used, and a domain can be verified by only one organisation.

2. Create a SAML app in your identity provider

SwfTap shows the details to enter. You'll always need these three:

• •ACS URL (also called the reply URL or single sign-on URL).
• •Entity ID (also called the audience URI or identifier).
• •NameID: the user's immutable id in your identity provider, with the Persistent format (not their email, which can be changed or given to someone else). Also send an email attribute, and a name attribute if you'd like people's names filled in.

Okta

• •In the Okta Admin Console, go to Applications > Applications > Create App Integration and choose SAML 2.0.
• •Paste the ACS URL into Single sign-on URL and the Entity ID into Audience URI (SP Entity ID).
• •Set Name ID format to EmailAddress and Application username to Email.
• •Under Attribute Statements, add email = user.email, name = user.displayName and urn:oasis:names:tc:SAML:attribute:subject-id = user.id (the plain Okta user id, not a scoped value like id@domain; SwfTap identifies people by it).
• •Finish, assign the app to your people, then copy the Metadata URL from the app's Sign On tab.

Microsoft Entra ID

• •In the Microsoft Entra admin centre, go to Enterprise applications > New application > Create your own application, and choose a non-gallery app.
• •Open Single sign-on and choose SAML.
• •Under Basic SAML Configuration, paste the Entity ID into Identifier (Entity ID) and the ACS URL into Reply URL (Assertion Consumer Service URL).
• •Under Attributes & Claims, set the Unique User Identifier (Name ID) to user.objectid with the Persistent format, and keep the emailaddress claim (user.mail).
• •Assign users or groups, then copy the App Federation Metadata Url from the SAML Certificates section.

Google Workspace

• •In the Google Admin console, go to Apps > Web and mobile apps > Add app > Add custom SAML app.
• •Download the IdP metadata file on the Google Identity Provider details step (you'll upload it to SwfTap).
• •Paste the ACS URL into ACS URL and the Entity ID into Entity ID. Set Name ID format to EMAIL and Name ID to Basic Information > Primary email.
• •Map Primary email to email and, optionally, First name and Last name to firstName and lastName.
• •Turn the app on for your people under User access.

3. Connect, test and turn on

Back in SwfTap, paste the metadata URL (or choose Upload metadata file) and select Connect. Then select Test sign-in: a new tab signs you in through your identity provider. Use the same company address as your SwfTap admin account. After a successful test, select Turn on SSO sign-in. From then on, anyone typing an address on your domain at the login page sees Continue with SSO, and anyone who signs in with SSO for the first time joins your organisation as a Member while a seat is free.

4. Require SSO (optional)

Require SSO for @<your domain> stops password and Google sign-ins on your domain, on the web and in the SwfTap app. To make sure you can't lock yourself out, it can only be switched on from a session that signed in with SSO (the Test sign-in tab). Your identity provider then controls who can get in: removing someone there ends their access to SwfTap at their next sign-in.

Good to know

• •An SSO sign-in is a separate SwfTap account from a password account with the same email. If you were already a member, your SSO account gets the same role in your organisation.
• •Disconnect single sign-on at any time. People signed in with SSO are signed out straight away, and everyone uses their password again.
• •If your identity provider stops working, contact SwfTap support: we can switch single sign-on off for your organisation.
• •Each person's single sign-on identity gets its own SwfTap work account. SwfTap never joins two identities by email address, so a work email given to someone new can't open the previous person's account. If your identity provider or NameID changes, people get new work accounts at their next sign-in and the old ones stay until you remove them from the team.
• •To remove people automatically when they leave your organisation, connect your identity provider with SCIM: see Remove people automatically when they leave (SCIM).