Single Sign-On (SSO)¶
Everysk SSO uses SAML 2.0 (IdP-initiated) and is configured under Settings → Security → Single Sign-On. Work through the steps below in order. Because the ACS URL and SP EntityID are generated by Everysk the first time you save, your IdP app gets finished in two passes.
Step 1: Create the SAML app in your IdP¶
Note its IdP Entity ID and IdP SSO URL, and download its signing certificate (PEM, public key only). You'll need all three for the next step.
Step 2: Configure and enable Single Sign-On¶
Navigate to the Single Sign-On tab under Settings → Security in the UI. Enter the necessary information you gathered in Step 1, using the Field Reference below as your guide. Once the required fields are populated, toggle Enable Single Sign-On at the top of the screen and then Save. Saving generates your ACS URL and SP EntityID (see table below). Save these in a safe place for Step 3.
Single Sign-On settings screen
Step 3: Finish the SAML app in your IdP¶
Set Audience/Identifier = SP EntityID, and ACS/Reply URL = ACS URL.
Step 4: Configure additional attributes (optional)¶
Additional SAML attributes can be configured from the SSO screen in Everysk if your IdP maps on other attributes. We recommend mapping to Roles. This will enable new users to be automatically created on first sign-in. Just make sure the Role in Everysk is created beforehand.
Step 5: Test¶
From your IdP launchpad, have the test user open the Everysk app and confirm they land signed in. Also confirm that a user outside your allowed domains is rejected.
SP Values — shown after you save¶
| Item | Value & where it goes in your IdP |
|---|---|
| ACS URL | https://app.everysk.com/sso/saml/signin/<APP_ID> goes in the Assertion Consumer Service / Reply URL field. Binding must be HTTP-POST. <APP_ID> is a random ID generated for this connection, not your organization or workspace ID. |
| SP EntityID / Audience | Opaque string generated by Everysk when you save. It goes in the Audience / Identifier field, and is the same value as the last segment of the ACS URL. |
Example: If your ACS URL is https://app.everysk.com/sso/saml/signin/6f2b9ad14c8e, your SP EntityID is 6f2b9ad14c8e, the part of the URL after /signin/.
About Automatic Provisioning (JIT): A new user is created the first time they sign in, using the role your IdP sends. That role needs to already exist in Everysk. If it doesn't, sign-in fails.
Field Reference¶
Each control on the Single Sign-On screen, what to enter, and whether it's required:
| Field | What to enter | Required |
|---|---|---|
| Enable Single Sign-On | Master switch for the connection. Turn on together with the rest of the fields. | Toggle |
| IdP Entity ID | Your IdP's issuer URI (Entity ID / Issuer) from its SAML metadata. | Yes |
| IdP SSO URL | Your IdP's SAML 2.0 single sign-on endpoint (HTTP-POST), from its metadata. | Yes |
| Domains | Comma-separated email domains allowed to sign in (e.g. acme.com, acme.co.uk). Others are rejected even with a valid signature. Only enforced when Identify Users By = Email. |
Yes |
| Identify Users By | Email (NameID is the user's email) or a stable opaque ID. Must match how your IdP sends NameID. |
Yes |
| Additional SAML Attributes | Optional, but required for automatic role assignment: use Add Attribute Mapping, enter the exact attribute name your IdP sends (IdP Attribute Name, e.g. userGroup), and set Maps To = Role. Without this mapping, Everysk has no way to know which attribute carries the user's group. |
Optional |
| Certificates | Paste the IdP signing certificate in PEM (public key only, with BEGIN/END lines). Use Add New Certificate to hold more than one. | Yes |
About the signing certificate: Paste only the public key in PEM (including the BEGIN/END lines), never a private key. You can hold several certificates at once: to rotate, add the new one before your IdP signs with it, then remove the old one after cutover.