SSO Configuration

Configure single sign-on (SSO) to allow your team to log in with your corporate identity provider.

Supported Identity Providers

Okta

SAML 2.0

Azure AD

SAML 2.0 / OIDC

Google

OIDC

OneLogin

SAML 2.0

Any SAML 2.0 or OpenID Connect (OIDC) compliant identity provider is supported.

Prerequisites

Enterprise or Business plan subscription
Admin access to your identity provider
Admin access to your Lucaro workspace

SAML 2.0 Configuration

1. Get Lucaro Service Provider Details

Navigate to Workspace Settings → Authentication → SSO to find:

Entity ID	https://auth.lucaro.dev/saml/{workspace_id}
ACS URL	https://auth.lucaro.dev/saml/{workspace_id}/callback
Name ID Format	emailAddress

2. Configure Your Identity Provider

Create a new SAML application in your IdP and configure it with the Lucaro SP details. Map the following attributes:

SAML Attribute	Lucaro Field	Required
email	User email	Yes
firstName	First name	No
lastName	Last name	No
groups	Group membership (for role mapping)	No

3. Upload IdP Metadata

Upload your IdP's metadata XML or manually enter the SSO URL and certificate:

{
  "sso_type": "saml",
  "idp_metadata_url": "https://your-idp.com/app/xxx/sso/saml/metadata",
  // OR provide individual values:
  "idp_sso_url": "https://your-idp.com/app/xxx/sso/saml",
  "idp_certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
}

Role Mapping

Map IdP groups to Lucaro roles for automatic role assignment:

{
  "role_mapping": {
    "Analytics Admins": "admin",
    "Data Team": "editor",
    "Business Users": "viewer"
  },
  "default_role": "viewer"
}

Just-in-Time Provisioning

Enable JIT provisioning to automatically create Lucaro accounts for new SSO users:

Users are created on first SSO login
Roles are assigned based on group mapping
User attributes are updated on each login
Optionally restrict to specific email domains

Testing SSO

Save your SSO configuration
Click Test Connection to verify the setup
Log in with a test user account
Verify the user is created with correct role
Enable Enforce SSO to require SSO for all users