Set up single sign-on (SSO)
Set up single sign-on (SSO)
What is SSO?
Single sign-on (SSO) lets your team log in to Pave using your company's identity provider (IdP) instead of a separate email and password. When SSO is enabled, users authenticate through the same system they use for other workplace tools, so there is no additional password to manage.
SSO is available for eligible Pave accounts. If your account includes SSO, your Pave team will coordinate setup with you.
How login works with SSO
When SSO is enabled for your company, users go to the Pave login page, enter their email address, and select Continue to login. Pave detects that SSO is configured for the email domain and redirects the user to your company's identity provider. After authenticating there, the user is returned to Pave and logged in.
If your identity provider supports app tiles (for example, an Okta dashboard or Azure AD portal), users can also log in by selecting the Pave tile directly from the IdP. This starts the same authentication flow without visiting the Pave login page first.
SSO and password login
By default, enabling SSO does not disable password login. Users at your company can log in with either method. If your organization requires all users to authenticate through SSO, your Pave team can disable password login for your account. When password login is disabled, users who try to create an account with an email and password are prompted to use SSO instead.
Supported identity providers
Pave supports any identity provider that uses the SAML 2.0 protocol. Common providers include:
- Okta
- Microsoft Entra ID (Azure AD)
- OneLogin
- Google Workspace
- JumpCloud
If your IdP supports SAML 2.0 and is not listed here, it will still work with Pave.
Before you start
Setting up SSO is a collaboration between your IT team and Pave. Each side provides information the other needs to complete the configuration.
Your IT team provides to Pave:
- X509 signing certificate (in .cer or .pem format)
- Sign-in URL (also called SSO URL or login URL in some identity providers)
Pave provides to your IT team:
- Entity ID:
urn:auth0:pave-production:<connection-name> - ACS URL (Assertion Consumer Service URL):
https://auth.pave.com/login/callback?connection=<connection-name>
The <connection-name> value is specific to your organization. Your Pave team will provide the complete Entity ID and ACS URL when setup begins.
Certificate format
Provide the X509 signing certificate as a .cer or .pem file. If your identity provider gives you a Base64-encoded certificate string, save it to a file with a .cer or .pem extension before sending it. Pasting certificate text directly into an email or message can introduce formatting issues that prevent the connection from working.
Configure your identity provider
Your IT team completes the following steps in your identity provider. The exact screens and labels vary by provider, but the process is the same.
Create a SAML application
- In your identity provider, create a new SAML 2.0 application for Pave.
- Enter the Entity ID and ACS URL that your Pave team provided.
- Save the application.
Configure attribute mapping
Your identity provider needs to send the following user attributes to Pave. Map each Pave attribute to the corresponding field in your IdP.
| Pave attribute | Map from your IdP |
|---|---|
| First name | firstName or givenname |
| Last name | lastName or surname |
| Email address | email or emailaddress |
| Email verified | nameidentifier |
Attribute mapping is case-sensitive. If any required attributes are missing or mapped incorrectly, users may see a "Verify your email" page or be unable to log in.
Assign users
Assign the users or groups who should have access to Pave in your identity provider. Users must be assigned to the Pave application before they can log in through SSO.
Export your configuration
Once the application is configured, export or copy:
- Your X509 signing certificate
- Your sign-in URL
Send both to your Pave team. After Pave completes the configuration, your team can test the connection.
Provider-specific configuration
The steps above apply to all identity providers. The sections below cover details specific to Okta, Microsoft Entra ID, and JumpCloud.
Okta
- When creating the SAML application, set Name ID format to EmailAddress.
- In the Attribute Statements section, add the following mappings:
| Attribute name | Value |
|---|---|
| user.email | |
| firstName | user.firstName |
| lastName | user.lastName |
- After saving, go to the Sign On tab, select Settings, then select View Setup Instructions to find the Identity Provider SSO URL and download the X509 certificate.
Microsoft Entra ID (Azure AD)
- In the Azure portal, go to Enterprise Applications and create a new non-gallery application (or select an existing one).
- Under Manage, select Single sign-on, then select SAML.
- In Basic SAML Configuration, enter the Entity ID and ACS URL provided by your Pave team.
- In User Attributes & Claims, confirm the following default mappings are in place:
| Claim name | Source attribute |
|---|---|
| emailaddress | user.mail |
| givenname | user.givenname |
| name | user.userprincipalname |
| surname | user.surname |
- Under SAML Signing Certificate, download the Certificate (Base64).
- Send the certificate and the App Federation Metadata URL to your Pave team. Pave uses this URL to complete the connection configuration.
JumpCloud
- In JumpCloud, go to SSO and add Pave as an application.
- Enter the ACS URL in the ACS URL field. Enter the Entity ID in both the IdP Entity ID and SP Entity ID fields.
- Check the Sign Assertion box. The connection will not work without this setting enabled.
- In the User Attributes section, add the following mappings:
| Attribute name | Value |
|---|---|
| id | |
| firstName | firstname |
| lastName | lastname |
- Provide the Identity Provider SSO URL and IDP Certificate to your Pave team.
Test the connection
After your Pave team confirms that setup is complete:
- Go to the Pave login page.
- Enter your email address and select Continue to login.
- You should be redirected to your company's identity provider login page.
- Authenticate with your IdP credentials.
- You should be returned to Pave and logged in.
If your IdP supports app tiles, also test by selecting the Pave tile from your IdP dashboard to confirm that flow works.
Troubleshooting
"Verify your email" page appears
One or more required attributes are not mapped correctly in your identity provider. Check that first name, last name, email address, and email verified are all mapped and that the attribute names are spelled correctly (mapping is case-sensitive).
403 error
The user has not been assigned to the Pave application in your identity provider. Assign the user to the application and try again.
"Page not found" error
The sign-in URL configured for the connection may be incorrect. Verify that you are using the correct SSO URL from your identity provider. In Okta, the correct URL typically ends with /sso/saml. If you recently changed your IdP configuration or created a new SAML tile, confirm the URL has been updated on Pave's side as well.
Login loop or endless spinner
Authentication may be completing on the IdP side but failing on the return to Pave. This can happen when the ACS URL or Entity ID in your IdP does not match what Pave has configured. Confirm that both values match exactly, including capitalization and any trailing characters.
"Something went wrong" error
This usually indicates an issue with the X509 signing certificate. The certificate may not have saved correctly during setup, may be in the wrong format, or may have expired. Verify that the certificate is current and was provided as a .cer or .pem file.
Frequently asked questions
How do I renew an expiring certificate?
When your IdP's signing certificate is approaching expiration, export a new certificate from your identity provider and send it to your Pave team. Pave will update the certificate on its side. Plan to do this before the certificate expires, because an expired certificate will prevent all SSO users at your company from logging in.
What happens if my company changes its email domain?
SSO is tied to your company's email domain. If your company rebrands, consolidates domains, or changes email addresses, SSO will stop working until Pave updates the configuration to match the new domain. Contact your Pave team before the domain change takes effect so the transition can be coordinated.
Can I switch to a different identity provider?
Yes. If your company is moving from one IdP to another (for example, from Google Workspace to Entra ID), your Pave team will create a new SAML connection for the new provider. Your IT team configures the new IdP using the same process described in this article, and Pave updates the connection on its side.
Can some users use SSO while others use a password?
Yes. By default, both login methods are available. If your organization wants to require SSO for all users, your Pave team can disable password login for your account.