Single Sign-On (SSO)

Alium supports SAML 2.0 single sign-on, so your team signs in through your company's identity provider (IdP), such as Okta, Microsoft Entra ID, or Google Workspace. Once SSO is turned on, it applies to everyone on your Alium team.

Available on Enterprise plans. Contact help@alium.io to enable it for your team.

What's supported

Feature	Details
Protocol	SAML 2.0. OpenID Connect (OIDC) is not supported.
Sign-in flows	IdP-initiated (the Alium tile in your IdP dashboard) and SP-initiated (entering your email on the Alium sign-in page)
User identifier	The user's email address
Provisioning	Manual. SCIM and just-in-time (JIT) provisioning are not supported. Each person needs an Alium account before their first SSO sign-in (see Managing users).
Roles	Set inside Alium (team admin or member). Your IdP can't assign Alium roles.

Alium's SAML values

A customer admin can find these values under Account → Single Sign-On:

Setting	Value
Metadata URL	https://app.alium.io/saml/metadata
ACS URL (Single sign-on URL)	https://app.alium.io/users/auth/saml/callback
Entity ID (Audience URI)	https://app.alium.io
Name ID format	urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

If you don't see Single Sign-On in your account menu, either you aren't a customer admin or SSO isn't enabled for your team yet. Contact help@alium.io.

Setting up SSO with Okta

1. Create the app in Okta

1. In the Okta Admin Console, go to Applications → Applications and click Create App Integration.
2. Choose SAML 2.0 and click Next.
3. Name the app Alium, then click Next.
4. Under SAML Settings, enter:
   • Single sign-on URL: https://app.alium.io/users/auth/saml/callback
   • Audience URI (SP Entity ID): https://app.alium.io
   • Name ID format: EmailAddress
   • Application username: Email
5. Optionally, add attribute statements for email, firstName, and lastName mapped to the user's profile.
6. Finish the wizard, then assign the app to the people or groups who should have access to Alium.
7. On the app's Sign On tab, copy the Metadata URL.

The Name ID must be the user's email address

Alium identifies each person by the email address in the SAML Name ID. It has to match the email on their Alium account exactly. If people see an error after signing in through Okta, check this setting first.

2. Connect Okta in Alium

1. In Alium, go to Account → Single Sign-On.

2. Paste Okta's metadata URL into Metadata URL and click Import from Metadata URL. This fills in the SSO URL, Entity ID, and X.509 certificate for you.

   If you'd rather not use the metadata URL, enter the values by hand under Manual Configuration: the SSO URL (Okta's Identity Provider Single Sign-On URL), the Entity ID (Okta's Identity Provider Issuer), and the X.509 Certificate.

3. Click Test Configuration. This checks that Alium can reach your IdP's sign-in URL. It doesn't run a full sign-in.

4. Check Enable SSO for my team and click Save SSO Settings.

3. Test a real sign-in

Stay signed in to Alium in your current browser window. Then open a private window and sign in from the Alium tile in Okta, or by entering your email at app.alium.io. If something isn't right, go back to your open window and uncheck Enable SSO for my team while you fix it.

Other identity providers

Any SAML 2.0 IdP works the same way. Create a SAML app using Alium's SAML values and make sure the Name ID is the user's email. Then connect it in Alium using step 2 above. Most IdPs publish a metadata URL you can import.

What changes when SSO is on

• SSO applies to the whole team. Individual users can't be exempted.
• Signing in with a password, resetting a password, and requesting a sign-in link from the Alium sign-in page all redirect to your IdP.
• If you lose access (for example, your IdP certificate rotates or the app is misconfigured), any customer admin who is still signed in can uncheck Enable SSO for my team. If no admin can sign in, contact help@alium.io and we'll turn SSO off for your team so you can fix the configuration.

Managing users

Alium doesn't create or remove accounts based on your IdP, so manage access in both places. Customer admins manage accounts under Account → Team members. If you don't see that page, help@alium.io can add or deactivate people for you.

• Adding someone: create their Alium account first, then assign them the Alium app in your IdP. People without an Alium account can't sign in through SSO, even if your IdP lets them through.
• Removing someone: unassign them in your IdP, and deactivate them in Alium. Deactivating them in Alium is what frees their seat and fully removes their access.
• Seat limits: the number of active accounts is limited by your plan's seats. SSO doesn't change that.

Troubleshooting

What you see	What to check
"We didn't receive your email address"	Your IdP isn't sending an email. Set the Name ID format to EmailAddress and the application username to the user's email.
Sign-in fails after your IdP sends the person back to Alium	The person doesn't have an active Alium account, or their IdP email doesn't match their Alium email exactly. Add or reactivate them in Alium.
The Alium tile in your IdP doesn't sign anyone in	Check that Enable SSO for my team is checked and the IdP settings are saved.
Import from Metadata URL fails	Check that the URL is publicly reachable and returns your IdP's SAML metadata XML, or enter the values manually.