# Use SSO \(Single Sign-On\) with Teamtailor Teamtailor lets you use Single Sign-On (SSO) through SAML 2.0, an open standard data format for exchanging authentication and authorization information. This allows your team to log in to Teamtailor using their existing corporate credentials. ​ In this article, you will find information about: 1. [SSO configuration](#h_d91e3471a2) 2. [Manage access via SSO](#h_996341bc96) 3. [User creation and role mappings](#h_963800130b) 4. [SSO configuration errors](#h_056bff137c) With SSO enabled, all users will access the platform using their **corporate credentials** rather than a Teamtailor-specific email and password. New users added to the platform **won’t receive email invitations**, as they will log in directly with their corporate credentials. # SSO Configuration As a Company Admin, you can set up the SSO login method in Teamtailor by navigating to **Settings → Security →** **Single sign-on (SSO)**. ![](https://downloads.intercomcdn.com/i/o/c3b2d8b8e567c16a39d8495a5b1b2b3865dd4dc7/2422175240/5bcf2219e268f837aaa2ba96face/image.png?expires=1793902500&signature=d3f8de0fcd202ddb6701a290e6eb3a20ffd971b1edb6f23b02b79e56cae1b36f&req=diQlFMh5mINbWfMW1HO4zZTs7%2B6pQpwAe7qOm4JapxFdaRl7O51Vc8PDnCgh%0AkAQNaqBaU2LZ0B%2Bm4%2FI%3D%0A) To configure the SSO integration, you will first need to configure your SSO provider (often AzureAD, Google, or Okta) with the following information from Teamtailor: - Entity ID - Assertion Consumption Service (ACS) URL ![](https://downloads.intercomcdn.com/i/o/c3b2d8b8e567c16a39d8495a5b1b2b3865dd4dc7/2422180826/20e4b6e7f2a0ccc88e9fd8dd38a1/image.png?expires=1793902500&signature=2146bb84dddfea72fd0f635e42ba794b7ca8cd676b40c3e3ec0c315b6443eba4&req=diQlFMh2nYldX%2FMW1HO4zctZ8RaIfHbAvCTqntHbZXPEvPdj9d2xjlZTMEN6%0A%2FcbINhxT43H9WAOK9VQ%3D%0A) You will also need to configure Teamtailor with the following information from your SSO provider: - Sign-in URL - Signing certificate (in Base64 encoded format) This is done by either: **1)** Uploading the metadata file from your Identity Provider (IdP) or ​**2)** Entering the URL from where the metadata file can be fetched ![](https://downloads.intercomcdn.com/i/o/c3b2d8b8e567c16a39d8495a5b1b2b3865dd4dc7/2422187897/3c891088bcca73f864297a0d099e/image.png?expires=1793902500&signature=33b80c52c1dc0b496e2d8cc0075d601f4c3d98bb84d938ff955f8b947b9bb039&req=diQlFMh2molWXvMW1HO4zfjhR3ZoF51YTB5mKnj9AWUsnEyzLM8nUAfocQMo%0A4hqthM4xoX8JF1XlnNA%3D%0A) Please note that we expect you to send the *name-id* attribute in the *persistent* format; ​`urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` ## The SSO Auto-join domain Teamtailor uses the SSO Auto-join domain value to identify which company account(s) a user should be signed in to when signing in via the Teamtailor general login page. The SSO Auto-join domain will be identified automatically based on the information provided in the SAML response message from your IdP. In case you have another domain from what we picked up, or if you use several, reach out to our support at , and we will help you configure it. # Manage access via SSO ## Enforce SSO on all users When the configuration is completed and you have ensured it works for users to log in, you can go ahead and *enable* SSO for all users. You do this by clicking on **→ Enforce SSO.** ![](https://downloads.intercomcdn.com/i/o/c3b2d8b8e567c16a39d8495a5b1b2b3865dd4dc7/2422200860/f94299b10b605bf07b0bae8a68f1/image.png?expires=1793902500&signature=579df4b896d316d14fd8eef0039edd40ea8d292e4c113ea42b104d8466efca56&req=diQlFMt%2BnYlZWfMW1HO4zfAwKASC10q6BYjntTiDZqPM5jFz36Fx8nA0u48k%0AR%2FmKCmFr0VucwURtVfA%3D%0A) ## Exclude individual users from SSO login In some cases, you may want to exclude users from logging in via SSO, maybe they are external consultants or recruiters, or for other reasons lack a company login. In order to exclude users, you must make sure they are added as an **Employee**, and then simply search for the email or the name in the list of users. ![](https://downloads.intercomcdn.com/i/o/c3b2d8b8e567c16a39d8495a5b1b2b3865dd4dc7/1264484087/48f7f8673351730521580d8854b6/image.png?expires=1793902500&signature=ac768186b604746a636a1595c4a3e942da767be92a9715867f73cf75c066fb72&req=dSIhEs12mYFXXvMW1HO4zQM0DIRdvJPZB7a8Z9iVwd%2Ftk32WFivSa8JnXSwP%0A6AxZZsju%2BZLXhYmDTFc%3D%0A) Please note that users invited as [External Recruiters](https://support.teamtailor.com/en/articles/3992866-work-with-external-recruiters)are always excluded from the SSO. # User creation and role mappings The first time a new user logs in to the system using Single Sign-On, they will automatically be created as a user of the company account. You will be able to decide which level of access new users should be created with. To better understand our different access roles, see more information here: [Invite users and select the right access](https://support.teamtailor.com/en/articles/113627-teamtailor-user-roles). ## Decide the Default user role All users that are created via SSO are assigned the [Default user](https://support.teamtailor.com/en/articles/113627-invite-users-and-select-the-right-access#h_56271d12a4) role in Teamtailor by default. However, you can decide what access role new users at your company should be given. Simply pick the role from this list that suits your company the best: ![](https://downloads.intercomcdn.com/i/o/c3b2d8b8e567c16a39d8495a5b1b2b3865dd4dc7/2422204953/298141fd7ad970e8d171079b7736/image.png?expires=1793902500&signature=0e72eacd26c6105b80fd0d064e005cf8d046acdfe61fd6727db575a0201b2074&req=diQlFMt%2BmYhaWvMW1HO4zdECGBb8fAnhhO883mLq4lAZ1%2FIApbq2RkwmPYVg%0Ac03MQ2p9KbwIKDtuVN4%3D%0A) ## Assign different user roles via User mappings In case you prefer to give users different access roles upon creation, you can do this with **User mappings → Add user mapping**. ![](https://downloads.intercomcdn.com/i/o/c3b2d8b8e567c16a39d8495a5b1b2b3865dd4dc7/1264537643/c0db6f849f5295eaedcd51bd0b78/image.png?expires=1793902500&signature=d71a0f42d957ee4db8d5f5c66a16f80559c90a91da12cd82b820e187975f4bd2&req=dSIhEsx9modbWvMW1HO4zWyIi4FuB85biaGjT9jHJSKksQs5oEWt4%2Bw3fgTI%0ArbVGiZGXCEpNTjNVnxE%3D%0A) Please see the table below to better understand the information requested when adding your mapping: | Target key | The attribute in Teamtailor that you would like to map | | ------------ | ----------------------------------------------------------------------------------------------------- | | Target value | The values available for the attribute in Teamtailor | | Source key | The attribute provided by your Identity Provider (IdP) | | Source value | The value provided by your Identity Provider (IdP) that will determine the Target value in Teamtailor | Please note that you can always change a user role manually and you can add as many mappings as you like. We only support user mapping upon *creation*, we never perform any updates of the mapping during logins. If you are using our [Group solution](https://support.teamtailor.com/en/articles/5335169-group-solution), please reach out to or your CSM if you need support with any of the following: - Additional user mappings for users to be created on the correct Teamtailor company account - Configuring additional Single Sign-On(s) for a unique sub-company account(s) # SSO configuration errors Here you will find a summary of errors that can occur due to misconfigurations in the Single Sign-On (SSO). To resolve the potential issues, changes may need to be made in both Teamtailor and in your Identity Provider (IdP) (AzureAD, Google, Active Directory, Okta, etc.). The errors may be displayed on the login page for unique users or inside Teamtailor under **Settings → Security → Single-sign on (SSO)**. Below you will find error descriptions and resolutions for them: ## Error: Invalid Signature on SAML Response | **Description** | **Resolution** | | -------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | This error indicates that the cryptographic signature of the SAML response from the IdP does not match the certificate stored in Teamtailor. | Create a new certificate in your IdP and upload the new certificate to Teamtailor. | ## Error: Invalid Audience **Full error message:** Invalid Audience. The audience , did not match the expected audience /metadata> | **Description** | **Resolution** | | ---------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | This error is shown if the customer has entered the wrong information in the Entity ID field in their IdP. | Update or change the **Entity ID** in your IdP. The value in the Entity ID should be in the form of `[/metadata>]` | Prefer reading in your own language? Check out our other support centers available at the top of the page 🌍