Setting up single sign-on
Let people sign in with Microsoft Entra ID, Okta, Google Workspace or another identity provider using OIDC or SAML.
Single sign-on (SSO) lets people sign in to AssetTrove with the account they already use for work. AssetTrove supports the two common standards, OIDC and SAML 2.0, so it works with Microsoft Entra ID, Okta, Google Workspace and most other identity providers.
You need the Owner or Admin role. Everything below happens on the Security page in AssetTrove, which also shows the exact values to copy into your identity provider.
Microsoft Entra ID (OIDC)
- In the Entra admin center, register a new app.
- Add the redirect URI shown on AssetTrove's Security page. It ends in
/api/auth/oidc/callback. - Create a client secret and note it.
- In AssetTrove, choose OIDC and enter the issuer URL, client ID and client secret.
AssetTrove checks the issuer as soon as you save, so a typo fails straight away instead of at someone's first sign-in.
Okta (OIDC or SAML)
Add an app integration in Okta, choosing OIDC or SAML, and enter the values from AssetTrove's Security page. Then copy Okta's details back into AssetTrove, as for Entra above.
Google Workspace (SAML)
- In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app.
- Enter the ACS URL and entity ID shown on AssetTrove's Security page.
- Copy Google's SSO URL and certificate into AssetTrove.
- Turn the app on for the users or organisational units who need it.
Any other SAML provider
AssetTrove shows its ACS URL, entity ID and a metadata URL that most providers can import directly. Enter your provider's entity ID, SSO URL and signing certificate in AssetTrove.
Important Use a persistent NameID in SAML. AssetTrove recognises people by this stable ID, never by email address, so renaming someone's email in your identity provider doesn't create a second account.
Test before you rely on it
- Verify your email domain. People can then choose Sign in with SSO and just type their email address.
- Open a private browser window and select Sign in with SSO.
- Once it works, you can require SSO for everyone.
Creating accounts at first sign-in
By default, people need an account in AssetTrove before they can sign in with SSO, either by invitation or through SCIM. You can optionally let AssetTrove create an account automatically the first time someone from a verified domain signs in. Those accounts get the Employee role. This option is ignored while SCIM is on.