Docs

Configure single sign-on with Okta, Azure AD, Google Workspace, or any SAML 2.0 IdP.

SSO is included on Enterprise plans. We support any SAML 2.0 identity provider — Okta, Azure AD, Google Workspace, OneLogin, JumpCloud, Auth0.

Why SSO?

  • One credential per teammate (no password sprawl)
  • Centralised offboarding (deactivate in your IdP → access revoked everywhere)
  • Compliance-friendly (SOC 2 / ISO 27001 / DORA reviewers love it)

Step 1 — Get your SP metadata

Visit Account → Org → SSO. We'll show:

  • SP entity ID — https://qortrace.com/saml/sp/<your-org-id>
  • ACS URL — https://qortrace.com/saml/acs/<your-org-id>
  • NameID format — urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Step 2 — Create the app in your IdP

Okta

  1. Apps → Browse App Catalog → "Create New App" → SAML 2.0
  2. Paste our SP entity ID and ACS URL
  3. Set NameID = email
  4. Add attribute statements:
    • email → user.email
    • firstName → user.firstName
    • lastName → user.lastName
    • groups → user.groups (filter to QorTrace-relevant groups)

Azure AD

  1. Enterprise applications → New application → Non-gallery → "QorTrace"
  2. Single sign-on → SAML
  3. Same fields as Okta

Google Workspace

  1. Apps → Web and Mobile Apps → Add custom SAML app
  2. Same fields. Google's IdP metadata XML downloads automatically.

Step 3 — Send us your IdP metadata

Either paste the IdP metadata XML in Account → Org → SSO → IdP metadata or upload the .xml file. We auto-extract:

  • Entity ID
  • Sign-in URL
  • Signing certificate

Step 4 — Map IdP groups to QorTrace roles

For each IdP group you sync, pick a target role:

  • qortrace-owners → Owner
  • qortrace-security → Security
  • qortrace-sales → Sales
  • ...

Members in those groups auto-provision the first time they sign in. Removing them from the group revokes access.

Step 5 — Test

Use the Test SSO button. We'll redirect you to your IdP, then back to a confirmation page. If anything fails, we show the exact SAML response error so you can fix it without ticket ping-pong.

SCIM provisioning (optional)

If you also want auto-deprovisioning of removed users, enable SCIM:

  1. Account → Org → SSO → Enable SCIM
  2. Copy the SCIM endpoint + bearer token
  3. Wire your IdP

We support SCIM 2.0 — Okta, Azure AD, OneLogin all work out of the box.

Forced SSO

Once SSO is working, flip Force SSO to lock out password-based logins for everyone except a designated emergency-access user. Standard practice for regulated orgs.

Troubleshooting

  • "InvalidNameIDPolicy" — your IdP isn't sending email format. Check the NameID config.
  • "AssertionExpired" — IdP and our clock are out of sync >5 min. Check NTP on your IdP.
  • "Unknown attribute" — group claim missing. Check the attribute statements in your IdP app config.

For anything else, your CSM is on Slack — typically responds within 1 business hour.