Single Sign-On
Waxell connects to the identity provider your company already uses, so people sign in with their work account, and you can remove their access from your directory instead of from Waxell.
| You want to… | Use |
|---|---|
| Sign in with Microsoft Entra, Okta, Google Workspace or any IdP | SSO (SAML 2.0 or OIDC) |
| Create accounts automatically the first time someone signs in | Account creation on first sign-in |
| Give people the right role and team from their IdP groups | Roles, teams and group mapping |
| Have your IdP create, update and remove people | SCIM provisioning |
| Pull users and groups from your directory on a schedule | Directory sync |
| Turn off passwords for your domain | Enforcing SSO |
| Get back in if your IdP is down | Owner recovery |
SSO is available on every Waxell workspace.
How it fits together
- Each workspace has its own identity providers. You configure SSO at
https://<workspace>.waxell.dev/settings/identity, and sign-in starts from that workspace's login page. One workspace's providers are never visible to another. - Email domains route people to a provider. On the login page someone types their email and clicks Continue with SSO; Waxell sends them to the provider in that workspace that lists their domain.
- Both protocols are supported. SAML 2.0 (SP-initiated, and IdP-initiated if you allow it) and OpenID Connect with PKCE, nonce and signed ID-token verification.
- Removing someone removes them everywhere. Deprovisioning through SCIM, directory sync or the Users page revokes their memberships, sessions, API keys, device ownership and delegations in one step. See Offboarding.
Start here
- Quickstart: working SSO in about ten minutes.
- The guide for your provider: Microsoft Entra, Okta, Google Workspace, or any SAML / OIDC provider.
- When sign-in works, add group mapping, SCIM, then enforce SSO.
Test on a second workspace first
Enforcing SSO turns off password sign-in for your domain on that workspace. If you're rolling SSO out to a workspace you rely on, try your setup on a test workspace first, and keep one owner account that can use the recovery link.