Single Sign-On

Configure self-serve SAML or OIDC SSO for your organization (Auth0, Okta, Entra)

Enterprise organizations can enable Single Sign-On (SSO) so team members sign in through your identity provider instead of a Taliiq password.

Configure everything yourself in Settings → SSO. No Taliiq support ticket is required for standard Auth0, Okta, or Microsoft Entra setups.

SSO is available when your plan includes SSO (Enterprise). Directory sync remains a future entitlement and is not configured in this guide.

Before you start

You need an Owner or Admin role
Your organization must be on a plan with SSO enabled
Choose one protocol per organization: OIDC (authorization code + PKCE) or SAML 2.0 (SP-initiated)

Enable SSO in the dashboard

Open Settings → SSO.

Choose protocol (OIDC or SAML).

Copy the callback / ACS URL shown on the form and register it at your identity provider (dashboard origin, not the API host).

Add the email domains that should map to your organization (for example company.com — not your IdP tenant hostname).

Enter IdP details for the selected protocol, leave Require domain match on (recommended), turn Enable SSO on, and save.

Callback and ACS URLs

Paste these into your IdP allowlist:

Protocol	URL
OIDC callback	`https://dashboard.taliiq.com/callback/sso/oidc`
SAML ACS	`https://dashboard.taliiq.com/callback/sso/saml`

Local development: http://localhost:5173/callback/sso/oidc and http://localhost:5173/callback/sso/saml.

The form always shows the correct URLs for your current environment.

Open the dashboard login page and choose Sign in with SSO
Enter a work email on a configured domain
Complete authentication at your identity provider
Return to Taliiq with a signed-in session

If the email domain is not mapped (or SSO is disabled), the login page refreshes without revealing organization details.

Discovery only routes by the typed email domain. The signed-in identity is always the email asserted by the IdP.

Email domains and domain match

Email domains — work domains used for SSO discovery (e.g. acme.com)
Require domain match (default on) — after IdP login, the asserted email must be on a configured domain before login or JIT provisioning

Turn domain match off only for testing or unusual IdP setups. When off, any account that can complete IdP login may join the organization.

Configure OIDC

Use OIDC when your IdP supports OpenID Connect (authorization code + PKCE). Taliiq fields:

Taliiq field	Meaning
Issuer	IdP issuer / authority URL (`https://…`)
Client ID	Application / client ID
Client secret	Confidential client secret

Optional overrides (usually filled via discovery): authorization endpoint, token endpoint, JWKS URI.

Auth0 (OIDC)

In Auth0, create an application of type Regular Web Application.

Allowed Callback URLs: paste the OIDC callback from Settings → SSO (https://dashboard.taliiq.com/callback/sso/oidc).

Allowed Logout URLs / Web Origins: your dashboard origin (optional but recommended).

Copy Domain into Taliiq Issuer as https://YOUR_DOMAIN/ (include https:// and trailing slash if Auth0 shows it).

Copy Client ID and Client Secret into Taliiq. Set protocol to OIDC, add email domains, enable, and save.

Okta (OIDC)

In Okta Admin, create an OIDC app integration (Web Application).

Sign-in redirect URIs: paste https://dashboard.taliiq.com/callback/sso/oidc from Settings → SSO.

Grant scopes openid, profile, and email.

Issuer in Taliiq is typically https://YOUR_OKTA_DOMAIN/oauth2/default (or the issuer shown on the Authorization Server).

Copy Client ID and Client secret into Taliiq. Protocol OIDC, email domains, enable, save.

Okta	Taliiq
Issuer / Authorization Server	Issuer
Client ID	Client ID
Client secret	Client secret
Sign-in redirect URI	OIDC callback URL

Microsoft Entra ID (OIDC)

In Microsoft Entra ID, register an application (App registrations).

Authentication → Redirect URIs (Web): paste https://dashboard.taliiq.com/callback/sso/oidc.

Create a client secret under Certificates & secrets.

Issuer in Taliiq: https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0 (or the issuer from the OpenID metadata document).

Copy Application (client) ID and the secret value into Taliiq. Protocol OIDC, email domains, enable, save.

Entra	Taliiq
OpenID issuer / authority	Issuer
Application (client) ID	Client ID
Client secret value	Client secret
Redirect URI	OIDC callback URL

Ensure the ID token includes an email (or UPN mapped to email). Domain match uses that asserted email.

Configure SAML

Use SAML 2.0 SP-initiated SSO. Taliiq fields:

Taliiq field	Meaning
SP entity ID	Audience / Entity ID Taliiq presents (or leave blank to use the default metadata URL)
IdP entity ID	Issuer / Entity ID from your IdP
IdP SSO URL	HTTP-Redirect SSO endpoint
IdP X.509 certificate	Signing certificate (PEM or base64)

ACS URL for the IdP: https://dashboard.taliiq.com/callback/sso/saml (copy from the form).

NameID / email attribute must be an email address. Prefer emailAddress NameID format.

Auth0 (SAML)

In Auth0, create (or enable) a SAML2 Web App addon on your application.

Application Callback URL / ACS: paste https://dashboard.taliiq.com/callback/sso/saml from Settings → SSO.

Open Settings and paste the recommended JSON from the Taliiq SSO form (or the template below). Set audience to your Taliiq SP entity ID.

From Auth0 Usage, copy IdP SSO URL, Issuer (IdP entity ID), and certificate into Taliiq.

Protocol SAML, email domains, enable, save.

Recommended Auth0 SAML Settings JSON (replace placeholders):

{
  "audience": "<SP_ENTITY_ID>",
  "recipient": "<ACS_URL>",
  "destination": "<ACS_URL>",
  "signResponse": true,
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  ],
  "mapping": {
    "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
    "given_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
    "family_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
  }
}

How to verify Auth0 SAML: the login path should hit Auth0 /samlp/… (not only Universal Login). After success, the browser POSTs to your ACS URL, then lands on the dashboard.

Auth0 Usage	Taliiq
Identity Provider Login URL	IdP SSO URL
Issuer	IdP entity ID
Identity Provider Certificate	IdP X.509 certificate
Application Callback URL	SAML ACS URL

Okta (SAML)

In Okta, create a SAML 2.0 app integration.

Single sign on URL (ACS): paste https://dashboard.taliiq.com/callback/sso/saml.

Audience URI (SP Entity ID): match Taliiq SP entity ID (or the default metadata entity ID Taliiq uses).

Name ID format: EmailAddress. Map email (and optionally first/last name) attributes.

From Okta’s Sign On instructions, copy IdP SSO URL, Issuer, and X.509 certificate into Taliiq. Protocol SAML, domains, enable, save.

Okta	Taliiq
Identity Provider Single Sign-On URL	IdP SSO URL
Identity Provider Issuer	IdP entity ID
X.509 Certificate	IdP X.509 certificate
Single sign on URL	SAML ACS URL
Audience URI	SP entity ID

Microsoft Entra ID (SAML)

In Entra, create an Enterprise application and set up SAML single sign-on.

Reply URL (ACS): paste https://dashboard.taliiq.com/callback/sso/saml.

Identifier (Entity ID): match Taliiq SP entity ID.

Edit attributes & claims so Name ID is the user’s email (or a unique email claim).

Download the Base64 certificate, copy Login URL and Microsoft Entra Identifier, and paste into Taliiq. Protocol SAML, domains, enable, save.

Entra	Taliiq
Login URL	IdP SSO URL
Microsoft Entra Identifier	IdP entity ID
Certificate (Base64)	IdP X.509 certificate
Reply URL (Assertion Consumer Service URL)	SAML ACS URL
Identifier (Entity ID)	SP entity ID

Security notes

Taliiq validates SAML assertions with your stored IdP certificate only
OIDC uses authorization code + PKCE and verifies ID tokens against JWKS
Client secrets are encrypted at rest
Public discover / callback endpoints are rate-limited

Team roles

On this page