SSO and SCIM

Plan requirement: OIDC and SAML SSO require Business or Enterprise. SCIM provisioning requires Enterprise.

Configure SSO in a staging organization and keep a tested owner recovery account until the identity-provider flow is proven.

Configure OIDC

1. In Google, Microsoft Entra, Okta, or another identity provider, create an OIDC web application.
2. Add the callback URL shown in Orthalon Administration → Single sign-on.
3. Configure the minimum identity scopes: openid, profile, and email.
4. Copy the issuer/discovery URL, client ID, and client secret.
5. In Orthalon, add and verify a company email domain.
6. Choose OIDC, enter the provider values, save, and test in a private browser window.

The issuer must match the provider exactly and should use HTTPS. Redirect URI mismatch errors mean the provider callback does not exactly match the Orthalon URL for the current environment.

Configure SAML

1. Create a SAML application in the identity provider.
2. Copy the Orthalon ACS URL and entity ID into the provider.
3. Configure an email/name identifier that maps to the user's verified email.
4. Copy the provider SSO URL, entity ID, and signing certificate into Orthalon.
5. Verify the organization domain and test both successful and denied access.

Do not enable organization-wide enforcement until you have tested certificate formatting, clock synchronization, signed assertions, and a recovery path.

Configure SCIM

1. Open Administration → Single sign-on → SCIM in an Enterprise organization.
2. Generate a SCIM token and copy the displayed base URL.
3. In the identity provider, configure the base URL and bearer token.
4. Test the provider connection.
5. Assign a small group, then confirm users are created in the correct Orthalon organization.
6. Remove one test assignment and confirm the member is deactivated or removed as documented.

The token is organization-scoped and must be stored as an identity-provider secret. SCIM-created members count as seats. Revoke and replace the token if it is exposed.

Test safely

Test sign-in with an assigned user, an unassigned user, an email outside the verified domain, and an existing password user. Verify organization membership and role behavior after every test. Never assume a successful identity-provider login automatically grants access to every Orthalon organization.