|
| 1 | +--- |
| 2 | +title: Set up Single Sign-On (SSO) |
| 3 | +description: Let teammates sign in to Fern with your IdP (SAML or OIDC) |
| 4 | +--- |
| 5 | + |
| 6 | +<Markdown src="/snippets/enterprise-plan.mdx" /> |
| 7 | + |
| 8 | +Set up Single Sign-On (SSO) to sign in to Fern using the identity provider you already use. SSO setup requires coordination with Fern: you'll need configuration values from Fern (like callback URLs and entity IDs) to set up your IdP, and you'll share your IdP metadata back with Fern to complete the connection. |
| 9 | + |
| 10 | +Choose SAML or OIDC depending on your IdP, then follow the steps below for Okta, Google Workspace, or Microsoft Entra. |
| 11 | + |
| 12 | +<Note title="Using another provider?"> |
| 13 | + If you use another IdP, Fern will help you configure it. Reach out via Slack or [email protected] to get started. |
| 14 | +</Note > |
| 15 | + |
| 16 | +## Okta |
| 17 | + |
| 18 | +<Tabs> |
| 19 | + <Tab title="SAML"> |
| 20 | + <Steps> |
| 21 | + <Step title="Receive configuration values from Fern"> |
| 22 | + Fern will send you the SSO URL and Audience URI through a secure channel (not Slack/email). |
| 23 | + </Step> |
| 24 | + |
| 25 | + <Step title="Create and configure application in Okta"> |
| 26 | + In **Applications**, create a new app integration using **SAML 2.0**. Configure with these values: |
| 27 | + |
| 28 | + | Field | Value | |
| 29 | + | ----- | ----- | |
| 30 | + | Single sign-on URL | [value from Fern] | |
| 31 | + | Audience URI | [value from Fern] | |
| 32 | + | Name ID format | `EmailAddress` | |
| 33 | + |
| 34 | + Then, add attribute statements: |
| 35 | + | Name | Value | |
| 36 | + | ------ | -------------------------------------- | |
| 37 | + | `name` | `user.firstName + " " + user.lastName` | |
| 38 | + | `email`| `user.email` | |
| 39 | + </Step> |
| 40 | + |
| 41 | + <Step title="Send Fern your IdP metadata"> |
| 42 | + From the **Sign-On** tab, copy the Metadata URL and X.509 certificate. Send them back to Fern. Fern will enable the connection and run a test login with you. |
| 43 | + </Step> |
| 44 | + |
| 45 | + <Step title="Disable IdP-initiated login"> |
| 46 | + In the **General** tab under **App visibility**, enable **Do not display application icon to users**. This prevents IdP-initiated login flows, which carry security risks. |
| 47 | + </Step> |
| 48 | + |
| 49 | + <Step title="Assign users"> |
| 50 | + Assign the people who should access Fern. |
| 51 | + </Step> |
| 52 | + </Steps> |
| 53 | + </Tab> |
| 54 | + |
| 55 | + <Tab title="OIDC"> |
| 56 | + <Steps> |
| 57 | + <Step title="Receive configuration values from Fern"> |
| 58 | + Fern will send you the Redirect URI through a secure channel (not Slack/email). |
| 59 | + </Step> |
| 60 | + |
| 61 | + <Step title="Create and configure application in Okta"> |
| 62 | + In **Applications**, create a new **Web Application** using OIDC. Use Authorization Code grant and set the Redirect URI to the value Fern provided. |
| 63 | + </Step> |
| 64 | + |
| 65 | + <Step title="Send Fern your IdP credentials"> |
| 66 | + Share the Client ID, Client Secret, and your Okta domain (e.g., `<your-tenant>.okta.com`) back to Fern. Fern will enable the connection and run a test login with you. |
| 67 | + </Step> |
| 68 | + |
| 69 | + <Step title="Disable IdP-initiated login"> |
| 70 | + In the **General** tab under **App visibility**, enable **Do not display application icon to users**. This prevents IdP-initiated login flows, which carry security risks. |
| 71 | + </Step> |
| 72 | + |
| 73 | + <Step title="Assign users"> |
| 74 | + Assign the people who should access Fern. |
| 75 | + </Step> |
| 76 | + </Steps> |
| 77 | + </Tab> |
| 78 | +</Tabs> |
| 79 | + |
| 80 | +## Google Workspace |
| 81 | + |
| 82 | +<Tabs> |
| 83 | + <Tab title="SAML"> |
| 84 | + <Steps> |
| 85 | + <Step title="Receive configuration values from Fern"> |
| 86 | + Fern will send you the ACS URL and Entity ID through a secure channel (not Slack/email). |
| 87 | + </Step> |
| 88 | + |
| 89 | + <Step title="Create and configure application in Google"> |
| 90 | + In **Web and mobile apps**, choose **Add app → Add custom SAML app**. On **Service provider details**, enter these values: |
| 91 | + |
| 92 | + | Field | Value | |
| 93 | + | ----- | ----- | |
| 94 | + | ACS URL | [value from Fern] | |
| 95 | + | Entity ID | [value from Fern] | |
| 96 | + | Name ID format | `EMAIL` | |
| 97 | + | Name ID | `Primary email` | |
| 98 | + |
| 99 | + Then, add attribute statements: |
| 100 | + | Google Directory Attribute | App Attribute | |
| 101 | + | -------------------------- | ------------- | |
| 102 | + | `First name` | `firstName` | |
| 103 | + | `Last name` | `lastName` | |
| 104 | + </Step> |
| 105 | + |
| 106 | + <Step title="Send Fern your IdP metadata"> |
| 107 | + Copy the SSO URL, Entity ID, and X.509 certificate from Google. Send them to Fern. Fern will enable the connection and run a test login with you. |
| 108 | + </Step> |
| 109 | + |
| 110 | + <Step title="Assign users"> |
| 111 | + Assign the people who should access Fern. |
| 112 | + </Step> |
| 113 | + </Steps> |
| 114 | + </Tab> |
| 115 | +</Tabs> |
| 116 | + |
| 117 | +## Microsoft Entra |
| 118 | + |
| 119 | +<Tabs> |
| 120 | + <Tab title="SAML"> |
| 121 | + <Steps> |
| 122 | + <Step title="Create an application"> |
| 123 | + Under **Enterprise applications**, select **New application → Create your own application → Non-gallery**. |
| 124 | + </Step> |
| 125 | + |
| 126 | + <Step title="Receive configuration values from Fern"> |
| 127 | + Fern will send you the Identifier (Entity ID) and Reply URL (ACS) through a secure channel. |
| 128 | + </Step> |
| 129 | + |
| 130 | + <Step title="Configure SAML"> |
| 131 | + In **Single Sign-On**, choose **SAML** and enter these values: |
| 132 | + |
| 133 | + | Field | Value | |
| 134 | + | ----- | ----- | |
| 135 | + | Identifier (Entity ID) | [value from Fern] | |
| 136 | + | Reply URL (ACS) | [value from Fern] | |
| 137 | + | Name ID | `user.primaryauthoritativeemail` (email) | |
| 138 | + |
| 139 | + Then, add attribute statements: |
| 140 | + |
| 141 | + | Name | Value | |
| 142 | + | ----------- | ---------------- | |
| 143 | + | `firstName` | `user.givenname` | |
| 144 | + | `lastName` | `user.surname` | |
| 145 | + </Step> |
| 146 | + |
| 147 | + <Step title="Send Fern your IdP metadata"> |
| 148 | + From **SAML Certificates**, copy the **App Federation Metadata URL**. Send it to Fern. Fern will enable the connection and run a test login with you. |
| 149 | + </Step> |
| 150 | + |
| 151 | + <Step title="Disable IdP-initiated login"> |
| 152 | + To prevent IdP-initiated login flows (which carry security risks), do not distribute the User access URL. |
| 153 | + |
| 154 | + Optionally, create a Conditional Access policy to block sign-ins that don't originate from your service provider. |
| 155 | + </Step> |
| 156 | + |
| 157 | + <Step title="Assign users"> |
| 158 | + In **Users and groups**, add the people who should access Fern. |
| 159 | + </Step> |
| 160 | + </Steps> |
| 161 | + </Tab> |
| 162 | +</Tabs> |
0 commit comments