SSO overview
TokenTimer Enterprise supports OIDC and SAML providers side by side. Each provider has a stable slug and its own sign-in button and callback URL.
- Keep administrator access. Start with a verified local administrator, or provision the license, provider secrets, and verified first-admin group before startup using SSO-only bootstrap.
- Configure one provider. Follow the OIDC quickstart or SAML quickstart, register its exact callback, and map emitted groups to roles.
- Verify a new login. Use a private browser window and confirm the expected workspace and administrator access before ending your existing session.
A group mapping can only match claims the IdP emits. Standard Google OIDC does not supply Workspace groups and cannot bootstrap a group-based administrator by itself.
Provider guides
| Provider | Protocols | Guide |
|---|---|---|
| Keycloak | OIDC (SAML optional) | Keycloak |
| Microsoft Entra ID | OIDC, SAML | Microsoft Entra ID |
| Okta | OIDC, SAML | Okta |
| Google Workspace | OIDC | Google Workspace |
| Auth0 | OIDC | Auth0 |
| Amazon Cognito | OIDC | Amazon Cognito |
| Active Directory Federation Services (AD FS) | SAML | AD FS |
Shared references:
- Claim mapping: claim path cheat-sheet
- Group mappings: map IdP groups to roles
- Configuration reference: bootstrap env vars and global SSO settings
- Authentication model: bootstrap and account linking
For shared URLs, network prerequisites, configuration surfaces, and runtime behavior, use the SSO setup reference.
Earlier section links
Links from the previous SSO overview
Sign-in flow at a glance
Continue in Sign-in flow at a glance.
Configuration surfaces
Continue in Configuration surfaces.
Prerequisites (all providers)
Continue in Prerequisites.
URLs TokenTimer uses
Continue in URLs TokenTimer uses.
API_URL / apiUrl must be the API origin
Continue in API_URL / apiUrl.
Choosing OIDC vs SAML
Continue in Choosing OIDC vs SAML.
Behavior reference (advanced)
Continue in Behavior reference.
Official documentation (starting points)
Continue in Official documentation.