Guide

SAML SSO

Let your organization sign in through your own identity provider — any SAML 2.0 IdP, managed by an org admin.

Overview

Sign in through your IdP

Anoman supports SAML single sign-on for organizations, via saml-jackson. An org admin registers a SAML connection to your identity provider; members then sign in through that IdP — Okta, Azure AD, Authentik, or any SAML 2.0 provider.

MFA-exempt: SSO-authenticated users skip Anoman's separate email-OTP MFA — your IdP has already vouched for them (and typically enforces its own MFA).

Admin CRUD

Register & manage connections

Connection management is admin-role and audited. POST /anoman/v1/sso/connections registers a connection and returns a slug plus the ACS URL and entity metadata to give your IdP. GET lists connections, and DELETE deactivates one.

# Admin registers a SAML connection to your IdP. Returns a slug + the
# ACS URL + entity metadata to paste into your IdP's SAML app config.
curl https://api.anoman.io/anoman/v1/sso/connections \
  -H "Authorization: Bearer anm-sk-..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Okta",
    "idp_metadata_url": "https://acme.okta.com/app/xxx/sso/saml/metadata"
  }'

# → 200
# {
#   "id": "sso_c1a2...",
#   "slug": "acme",
#   "acs_url": "https://api.anoman.io/auth/sso/callback",
#   "entity_id": "https://api.anoman.io/auth/sso/acme"
# }

From IdP to Anoman session

A member hits GET /auth/sso/{slug}/login and is 302-redirected to your IdP. After the IdP authenticates them, it POSTs the SAML assertion (POST binding) to POST /auth/sso/callback, and Anoman issues a session.

# 1. Member hits the org's SSO login URL (slug from registration)
GET https://api.anoman.io/auth/sso/acme/login
    → 302 redirect to your IdP

# 2. IdP authenticates the user (Okta / Azure AD / Authentik / any SAML 2.0)

# 3. IdP POSTs the SAML assertion back (POST binding)
POST https://api.anoman.io/auth/sso/callback
    → Anoman verifies the assertion, upserts the user, issues a session

# SSO-authenticated users are exempt from the separate email-OTP MFA —
# your IdP has already vouched for them.

Dashboard & audit

Where to configure it

Create, list, and deactivate connections in the dashboard at /dashboard/settings/sso — tier-gated to Pro and Enterprise.

Every SSO action is audited: sso.connection_created, sso.connection_deactivated, and sso.login on each IdP return.

Related: Organizations (roles & membership) and Audit log (where the sso.* events land).

Set up SSO

Open SSO settings Back to docs