Skip to content
PluraprintDocs

Start typing to search the documentation.

↑↓to navigateto open

Accounts & Authentication

Single Sign-On (SSO)

Connect your organization's identity provider so your team can sign in with their existing accounts.

Pluraprint supports signing in with your organization’s existing identity provider over OIDC, SAML 2.0, or CAS: for example Okta, Microsoft Entra ID (Azure AD), Google Workspace, OneLogin, or a university CAS service. Once connected, authorized users can sign in with the Sign in with… button on the sign-in page, using the same credentials they already use for everything else.

What you’ll need

Reach out to your Pluraprint contact to get started, and have the following ready from your identity provider’s admin console:

For OIDC providers (Okta, Entra ID, Google Workspace, etc.)

  • Issuer URL for your application/connection
  • Client ID and Client secret
  • The email domain your users sign in with (for example, example.edu). This is how Pluraprint knows which sign-ins should use your provider
  • Any non-default scopes your provider requires (Pluraprint requests openid, profile, and email by default)

For SAML providers

  • Your identity provider’s SSO URL and Entity ID / issuer
  • The signing certificate for your identity provider
  • The email domain your users sign in with

Pluraprint will provide you with a callback/redirect URL and service provider entity ID to enter into your identity provider’s application configuration.

For CAS providers

  • The CAS login URL
  • A CAS 2.0 serviceValidate or CAS 3.0 p3/serviceValidate URL
  • The stable username and email attribute names returned by the service

Setup process

  1. Contact your Pluraprint account team and let them know you’d like to connect SSO.
  2. Create a new application/connection in your identity provider for Pluraprint, using the redirect URL and entity ID we provide.
  3. Share the issuer, client credentials (or certificate), and email domain with us using a secure channel.
  4. We configure the connection on your deployment.
  5. Your team verifies sign-in by visiting the sign-in page and selecting the new Sign in with… button.

After SSO is connected

  • Anyone signing in for the first time via SSO automatically gets a Pluraprint account.
  • Administrators can still create accounts manually and assign roles: useful for service accounts or for assigning roles to people before their first sign-in.
  • Email/password sign-in can remain available alongside SSO when the deployment enables the local provider, so you can keep a tightly controlled break-glass administrator as a fallback.