Skip to main content
This page is for Overcut Cloud. On a customer-managed installation, see Single Sign-On for Self-Hosted Overcut.
Enterprise single sign-on (SSO) connects an Overcut workspace to the identity provider your organization already uses. Once connected, your team signs in with Continue with SSO on the login page, and your workspace decides whether new people from your email domain join automatically or only by invitation. Overcut supports both OpenID Connect (OIDC) and SAML 2.0. Okta, Microsoft Entra ID, Google Workspace, and any other provider that speaks one of these protocols work the same way.
SSO is connected by the Overcut team, not self-serve. You provide your provider’s details and email domains, Overcut binds the provider to your workspace, and from then on workspace admins manage it under Security → Single sign-on. Contact your Overcut account team or use the Ask to add SSO button on that page to start.

​
How it works

  1. A user opens the Overcut login page and chooses Continue with SSO.
  2. They enter their work email. Overcut looks up the email domain and, if a workspace has SSO bound to that domain, sends them to your identity provider.
  3. Your provider authenticates the user and returns their email, first name, and last name.
  4. Overcut matches the email to an existing account. An existing member is signed in. A user with an open invitation gets an account and the invitation is consumed. Anyone else is admitted or rejected according to the workspace’s auto-join setting (see Who can join).
People whose account is created through SSO land in your workspace. They never get a personal workspace of their own, and they skip the onboarding wizard.
If someone already has an Overcut account with the same email address (for example, one they sign in to with GitHub), their SSO login links to that account. They keep their workspace memberships, roles, and history, and both sign-in methods keep working afterwards. The same membership rules apply: the account must already be a member of your workspace, have an open invitation, or be admitted by auto-join.

​
Who can join

A workspace with SSO has two membership modes, controlled by one toggle in the provider’s settings dialog: Auto-join is scoped to the email domains bound to your workspace. Overcut never admits a user from a domain you did not register, whatever your provider returns.
Start in invitation-only mode for the verification login, then decide whether to switch on auto-join. You can change the toggle at any time; it applies to the next login.

​
Choosing OIDC or SAML

Both protocols are fully supported and produce the same experience for your users. Pick whichever matches your organization’s standard.

​
Set up SSO

Tell Overcut your domains and protocol

Send your Overcut account team:
  • The email domain or domains your users sign in with (for example acme.com and acme.io). Only domains your organization owns can be bound. Public mailbox domains such as gmail.com are refused.
  • Whether you will use OIDC or SAML.
  • The workspace to connect. Only one workspace can be bound to a given domain.
Overcut replies with a provider alias for your organization. The alias appears in the URLs below as <alias>.

Create the application in your identity provider

OIDCCreate a web application (in Okta: Applications → Create App Integration → OIDC - OpenID Connect → Web Application) with:Assign the users or groups who should be able to sign in, then send Overcut the issuer URL, client ID, and client secret. Share the secret through a secure channel, never in a ticket or chat message.SAML 2.0Create a SAML application (in Okta: Applications → Create App Integration → SAML 2.0) with:Add these attribute statements:Assign the users or groups who should be able to sign in, then send Overcut the identity provider metadata (the XML file or its URL). Overcut’s SP metadata is available at https://auth.overcut.ai/realms/overcut/broker/<alias>/endpoint/descriptor once the provider is connected, if your provider asks for it.

Overcut connects the provider

Overcut registers your provider and binds it to your workspace and domains. The provider then appears under Security → Single sign-on in your workspace, in invitation-only mode.

Verify with one user

Invite one person from your organization to the workspace, then have them sign in through Continue with SSO. They should land in your workspace as a member, with the invitation consumed. Signing in a second time should take them straight in.

Roll out to the team

Either invite the rest of your team, or open the provider’s settings and switch on Let anyone from these domains join automatically so anyone on your domains can sign in without an invitation.

​
Manage SSO in your workspace

Open the workspace, then go to Security → Single sign-on. The page lists every provider bound to the workspace with its display name and bound domains, plus a Disabled or Auto-join tag where those apply. Select the pencil icon on a provider to open its settings dialog:
  • Membership: the Let anyone from these domains join automatically toggle switches between invitation-only and auto-join (see Who can join).
  • Team sync: the Sync team memberships from IdP groups toggle turns on team sync from IdP groups.
  • Status: the Enabled toggle turns SSO on or off for this provider. While disabled, the login page no longer offers SSO for the provider’s domains, and sign-ins already in progress are rejected. Existing members can still sign in with any other method they have, such as GitHub.
Changing these settings requires the workspace settings permission. Other workspace members see the page read-only. Adding domains, changing the provider’s configuration, rotating an OIDC client secret, or replacing a SAML certificate all go through the Overcut team. Reach out with the new details and Overcut applies them.

​
Sync teams from IdP groups

Team sync puts people in the right Overcut teams from the groups they belong to in your identity provider. Teams carry roles, both workspace-wide and per project, so linking a team to a group grants that group’s members the team’s access as soon as they sign in. Nobody has to add new users to teams by hand. At each SSO sign-in, Overcut reads the user’s groups and, for every team linked to IdP groups:
  • adds the user when one of their groups is linked to the team, and
  • removes the user when none of their groups is.
Teams with no linked groups are never changed, so you can keep managing some teams by hand. The workspace owner is never removed from a team. Group values are matched as-is (ignoring case and surrounding spaces), so they can be group names or group IDs, whichever your provider sends. One group can be linked to several teams, for example an everyone group linked to a read-only team that has access to every project.

​
Set up team sync

Send groups from your identity provider

Configure your provider to include the user’s groups at sign-in, then ask the Overcut team to turn on group import for your provider. Tell them the claim or attribute name if it is not groups. On a self-hosted installation, you turn on group import yourself; see Sync teams from IdP groups.
  • Okta (OIDC): on the application’s Sign On tab, set a Groups claim named groups with a filter that matches the groups you want Overcut to see (for example, starts with overcut-).
  • Okta (SAML): add a Group Attribute Statement named groups with a filter for the relevant groups.
  • Microsoft Entra ID: add a groups claim under Token configuration. Entra sends group object IDs by default; choose Groups assigned to the application to keep the list short. With OIDC, users in more than 200 groups exceed Entra’s token limit, and their sync is skipped (their teams stay as they are). With SAML, the limit is 150 groups, and a user above it arrives with no groups and is removed from every linked team, so limiting the claim to assigned groups matters even more.
  • Google Workspace (SAML): add a Group membership attribute mapping named groups in the SAML app. Google’s OIDC sign-in does not send groups.
  • Other providers: any OIDC claim or SAML attribute that lists the user’s groups works.

Check which groups arrive

Have one user sign in with SSO, then open their page under Security → Users. The Identity provider groups section shows the exact values your provider sent. Use these values in the next step; this matters most for providers that send IDs instead of names.

Link groups to teams

Turn on Sync team memberships from IdP groups in the provider’s settings dialog. Then open each team under Security → Teams, and in Identity provider groups type each group and select Add. Changes save immediately.

Verify

Have the user sign in again. Their teams now match their groups, and their project access follows from the teams’ roles.
Turn on team sync only after the groups show up on a user’s page. With sync on, a user whose provider sends no groups is removed from every linked team at their next sign-in.

​
What team sync does not do

  • Changes apply at the next sign-in. Moving someone to another group in your provider updates their Overcut teams the next time they sign in with SSO, not immediately.
  • No offboarding. Removing a user from your provider stops them from signing in with SSO, but their Overcut account and memberships stay until a workspace admin removes them.
  • No lasting manual edits on linked teams. If you add or remove a member of a team linked to IdP groups by hand, their next SSO sign-in puts the membership back in line with their groups.
  • SSO sign-ins only. Signing in any other way, such as with GitHub, never changes team memberships.

​
Signing in with SSO

On the login page, choose Continue with SSO, enter your work email, and select Continue. You are redirected to your organization’s identity provider, and back to Overcut once it confirms who you are.
The domain of the email you entered is not bound to any workspace, or its provider is turned off. Check for a typo, or sign in with GitHub instead. If your organization should have SSO, ask your workspace admin to confirm which domains are bound.
The message reads “Your organization uses single sign-on, but <email> has not been invited to the <provider name> workspace yet. Ask a workspace admin to invite you.” Your identity provider accepted you, but the workspace is in invitation-only mode and there is no open invitation for your email. Ask a workspace admin to invite you, or to switch on auto-join.
A workspace admin switched the provider’s Enabled toggle off while you were signing in. Sign in another way, or ask an admin to re-enable it.
The application on your provider’s side is misconfigured or you are not assigned to it. Common causes: the redirect or ACS URL does not match the one Overcut gave you, the application is not assigned to your user or group, or a SAML certificate has expired. Your identity provider admin can check the application’s sign-in log.

​
Limitations

  • Overcut Cloud only. For customer-managed installations, see Single Sign-On for Self-Hosted Overcut.
  • No single logout. Signing out of Overcut ends your Overcut session but does not sign you out of your identity provider.
  • One workspace per domain. A given email domain can be bound to a single workspace.
  • No SCIM provisioning. Users appear in Overcut on their first SSO sign-in, and team sync runs at sign-in (see What team sync does not do).