Skip to content

Set up SSO and SCIM

OIDC, SAML, SCIM, and role controls are built. General customer rollout is not established.

Before you start

You need administrator access to GaugeDesk and your identity provider. Prepare a test group and a test person who does not have production access.

Set up OIDC or SAML

  1. In Administration, open Identity.
  2. Select OIDC or SAML.
  3. Enter the issuer or metadata from your identity provider.
  4. Set the required audience and claims.
  5. Add the redirect information to the identity provider.
  6. Save the configuration.
  7. Test sign-in with the test person.
  8. Test an invalid issuer, audience, signature, and expired assertion.

Do not require SSO for all administrators until a tested recovery administrator can sign in.

Set up SCIM

  1. Open Provisioning.
  2. Create a SCIM connection.
  3. Copy the endpoint and new credential to the identity provider.
  4. Map identity-provider groups to GaugeDesk roles.
  5. Provision the test group.
  6. Confirm create, update, group change, and deactivation.
  7. Rotate the credential after the setup test if your procedure requires it.

SCIM deactivation stops future account access. It does not erase project history.

Require SSO and MFA

GaugeDesk can require an accepted identity-provider MFA result. It does not perform the second factor itself.

Before enforcement:

  • test the required claim;
  • test a missing or false claim;
  • confirm recovery access;
  • record the change; and
  • tell affected people when enforcement starts.

Protect credentials

Do not put client secrets, signing keys, SCIM credentials, or recovery codes in Git, agent instructions, project files, chats, screenshots, or support requests. Store them in the approved secret system and rotate them after suspected exposure.

Success check

The setup is complete when valid test sign-in and provisioning work, invalid assertions fail, deactivation removes future access, and the audit view records each change.