Single Sign-On (SSO)

PilotBPM supports OpenID Connect (OIDC) and SAML 2.0 single sign-on with Microsoft Entra ID, Okta, Google Workspace, and other standards-compliant identity providers.

How it works

• Configure SSO per workspace with issuer/metadata, client credentials (OIDC) or certificates (SAML), and an email domain for login routing.
• Users enter their work email at /login/sso and are redirected to your IdP.
• After authentication, PilotBPM validates the response, checks the email domain, and signs the user in. New users are provisioned just-in-time with a configurable default role.

Setting it up

1. Open Admin → Integrations → Single sign-on (tenant admin) or Platform → tenant → SSO (platform staff).
2. Choose a provider preset and copy the Redirect URI (OIDC) or upload SP metadata (SAML) to your IdP.
3. Run Test connection, then enable SSO.
4. UAT at /login/sso with a matching work email.

See docs/INTEGRATIONS-SETUP.md for detailed checklists.