Set up single sign-on

Before you start

• Single sign-on is part of the Business plan and above. Only the owner of a team can set it up, because the connection decides who may sign in as whom.
• You need administrator access to your identity provider, and access to the DNS settings of your company's email domain.
• PDF Loft supports SAML 2.0 and OpenID Connect. Both give the same sign-in, so choose the one your provider handles best.

Connect your provider

1. Open Single sign-on in settings, choose SAML 2.0 or OpenID Connect, and select Create connection.
2. Copy the details shown under Details for your identity provider into your provider. The steps for Okta, Microsoft Entra ID and Google Workspace follow.
3. Return to PDF Loft. Under Identity provider details, upload the metadata file, give its address, or enter the details by hand. For OpenID Connect, enter the issuer address, the client ID and the client secret.
4. Under Email domains, add your company domain, publish the TXT record shown in its DNS settings, and select Verify.
5. Turn single sign-on on. Then open the sign-in page in a private window, choose Continue with single sign-on, enter your work email address and sign in once to test it.

Okta

1. In the Okta admin console, go to Applications, create an app integration and choose SAML 2.0.
2. Set the single sign-on URL to the reply address from PDF Loft and the audience URI to the entity ID. Set the name ID format to EmailAddress.
3. Add attribute statements named email, firstName and lastName, finish, and assign the app to the people who should sign in.
4. On the Sign On tab, copy the metadata address or download the metadata file, and give it to PDF Loft.

Microsoft Entra ID

1. In the Entra admin center, go to Enterprise applications and create your own application (non-gallery).
2. Open Single sign-on and choose SAML. In Basic SAML Configuration, set Identifier to the entity ID and Reply URL to the reply address from PDF Loft.
3. Keep the default attributes. PDF Loft reads the email claim, or the user principal name when that is an email address.
4. Download the Federation Metadata XML and upload it to PDF Loft.
5. Under Users and groups, assign the people who should sign in.

Google Workspace

1. In the Google Admin console, go to Apps, then Web and mobile apps, and add a custom SAML app.
2. Download the metadata file that Google shows and upload it to PDF Loft, then continue in Google.
3. Set the ACS URL to the reply address and the entity ID to the entity ID from PDF Loft. Set the name ID format to EMAIL and the name ID to Basic Information, Primary email.
4. Finish, then turn the app on for the organizational units that should use it.

Who is let in

• People sign in only with an address on a domain you verified. Anyone else is refused, even when your provider signs the response.
• With Add people when they first sign in on, a new person joins the team with the role you choose. With it off, only existing members can sign in.
• Require single sign-on closes every other way in for people on your verified domains. You can turn it on only after one successful sign-in through single sign-on. Owners keep their password.
• If a person has two-step verification on, PDF Loft still asks for their code after single sign-on.
• A person who already has a PDF Loft account signs in through single sign-on only if they already belong to your team or hold an open invitation to it. The owner of the team never signs in through your provider, so a provider setting cannot be used to take over the owner account.

Automatic provisioning

1. Under Automatic provisioning (SCIM), create a token and copy it. It is shown only once.
2. In your provider, enter the SCIM base address and use the token as the bearer token.
3. Provisioning creates and deactivates people. A deactivated person loses access to the team at once and keeps their own account. PDF Loft does not provision groups.