> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reducto.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on (SSO) FAQ

> How to configure SAML or OIDC single sign-on for your Reducto organization.

Reducto supports Enterprise SSO, letting your team log in with your identity provider (IdP) credentials. This page covers how setup works and answers common questions from IT and security teams.

## How SSO works at Reducto

Users sign in at [accounts.reducto.ai](https://accounts.reducto.ai). Enterprise SSO is configured per organization through a guided setup page. Once SSO is enabled for your organization, members can no longer log in with other methods such as email/password or magic link.

To get started, contact your Reducto account team or support. We will send you a shareable setup link that should guide you through the setup process.

## Setup process

<Steps>
  <Step title="Request SSO for your organization">
    Contact your Reducto account team to enable Enterprise SSO for your organization. We can also generate a setup link for the person configuring your IdP, even if they do not have a Reducto account.
  </Step>

  <Step title="Follow the guided setup for your IdP">
    The setup page provides step-by-step guides for Entra ID (Azure AD), Okta, Google, OneLogin, JumpCloud, Duo, Rippling, and Ping Identity, plus a generic guide for any other SAML 2.0 or OIDC provider. It supplies the values to enter into your IdP, including the ACS URL and SP Entity ID.
  </Step>

  <Step title="Provide your IdP details">
    For SAML, you enter your IdP SSO URL, IdP Entity ID, and the token signing certificate. The guide then walks through mapping user attributes and, optionally, roles.
  </Step>

  <Step title="Finish and go live">
    After clicking Finish & Go Live, the setup page shows your organization's login URL in the form `https://auth.reducto.ai/saml/{org_slug}/login`.
  </Step>
</Steps>

## Frequently asked questions

### SAML support

<AccordionGroup>
  <Accordion title="Do you support SAML 2.0?">
    Yes. Reducto supports SAML 2.0, with both SP-initiated and IdP-initiated logins. OIDC is also supported.
  </Accordion>

  <Accordion title="Which identity providers are supported?">
    Guided setup is available for Entra ID (Azure AD), Okta, Google, OneLogin, JumpCloud, Duo, Rippling, and Ping Identity. Any other IdP that supports SAML 2.0 works through the generic SAML integration.
  </Accordion>

  <Accordion title="What are the ACS URL and Entity ID?">
    Both values are shown in the guided setup page for your organization. Enter them into your IdP when creating the application (in Entra ID, these are the Reply URL and Identifier fields in Basic SAML Configuration).
  </Accordion>

  <Accordion title="Is the Sign on URL required? (Entra ID)">
    No. In Entra ID's Basic SAML Configuration, only the Identifier (Entity ID) and Reply URL (ACS URL) are required. The Sign on URL is only used when starting login from a bookmark or the My Apps portal tile. You may leave it blank, or set it to your organization's login URL: `https://auth.reducto.ai/saml/{org_slug}/login`.
  </Accordion>

  <Accordion title="Can you provide a Service Provider metadata file?">
    Yes. After completing the setup guide and clicking Finish & Go Live, take your organization's login URL (`https://auth.reducto.ai/saml/{org_slug}/login`) and replace `/login` with `/metadata`. Navigating to that URL downloads the SP metadata XML, which can be used for a Relying Party Trust configuration.
  </Accordion>

  <Accordion title="Do you support automatic token signing certificate rollover?">
    No. The IdP signing certificate is provided during setup. When your IdP rotates its token signing certificate, update the SAML connection with the new certificate by revisiting the setup page. We recommend configuring certificate expiry notifications in your IdP.
  </Accordion>
</AccordionGroup>

### Attributes and provisioning

<AccordionGroup>
  <Accordion title="Which attributes should the SAML response include?">
    The SAML response should include:

    | Attribute  | Required    | Notes                                              |
    | ---------- | ----------- | -------------------------------------------------- |
    | Email      | Yes         | Also used as the NameID / subject                  |
    | First name | Recommended | Mapped in the setup guide                          |
    | Last name  | Recommended | Mapped in the setup guide                          |
    | Role       | Optional    | IdP roles or groups can be mapped to Reducto roles |
  </Accordion>

  <Accordion title="Do you support mapping roles from our IdP?">
    Yes. The setup guides include directions for mapping roles from your IdP, including mapping based on group membership.
  </Accordion>

  <Accordion title="Do you support Just-In-Time (JIT) provisioning?">
    Yes. Users are provisioned automatically on their first SSO login.
  </Accordion>

  <Accordion title="Do you support SCIM provisioning?">
    SCIM is available for Okta, Entra ID, OneLogin, JumpCloud, and Ping Identity. Contact your Reducto account team to confirm availability for your organization.
  </Accordion>
</AccordionGroup>

### Login behavior

<AccordionGroup>
  <Accordion title="Can members still log in with a password after SSO is enabled?">
    No. Once Enterprise SSO is enabled for your organization, members (and users sharing your organization's email domain) can only log in through your IdP.
  </Accordion>

  <Accordion title="Do you support IdP-initiated login?">
    Yes. Both SP-initiated and IdP-initiated logins are supported.
  </Accordion>

  <Accordion title="Who can configure SSO for our organization?">
    Users with a role that includes the Enterprise SSO permission can configure it from the organization settings page.
  </Accordion>
</AccordionGroup>

## Need help?

Contact [support@reducto.ai](mailto:support@reducto.ai) or your Reducto account team for SSO setup assistance.