Setting up single sign-on
This page is for your IT department. CovaSyn speaks SAML 2.0 and is proven with Microsoft Entra ID, Okta and Google Workspace. The effort on your side is about 30 minutes; the first round including your change process typically takes two to five days.
1. Values for your application
Create a SAML application in your identity provider and enter these two values:
- Entity ID (identifier, audience)
https://jrfsgntjxdohiddptaaq.supabase.co/auth/v1/sso/saml/metadata
- ACS URL (reply URL, assertion consumer service)
https://jrfsgntjxdohiddptaaq.supabase.co/auth/v1/sso/saml/acs
Name ID format: email address (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress). Signing the assertion is required, encryption is optional.
2. Attributes
The email address is mandatory, since its domain assigns the user to your organisation automatically. The name attributes are optional and only ensure a name appears in the interface instead of an email prefix.
| Field | Claim | Required |
|---|---|---|
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress | yes | |
| first_name | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname | optional |
| last_name | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname | optional |
| full_name | http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name | optional |
Entra ID sends these long claim names by default. Okta and Google Workspace commonly use the short forms email, firstName and lastName; we accept both, so you do not need to rename anything.
3. What to send us
One line is enough: the metadata URL of your SAML application, plus the email domains that should route to this provider.
Metadaten-URL: https://login.microsoftonline.com/<tenant>/federationmetadata/2007-06/federationmetadata.xml Domains: ihre-firma.com, ihre-firma-labs.com
The URL is preferable to a metadata file: it stays valid when you rotate certificates, a one-off XML file does not. If your policies do not allow a URL, we take the XML file too.
4. Signing in
Once the provider is registered, your staff sign in on the login page via company SSO and enter only their work email address. An account is created automatically and assigned to your organisation, up to the agreed number of seats. There is no separate password.
Automatic deprovisioning via SCIM is available on request. Without SCIM, disabling the account in your identity provider also removes access, since no session can be established without a valid sign-in.
Common pitfalls
- Sign-in fails with a missing-provider message: the address domain is not registered. Tell us every domain, including subsidiaries and legacy ones.
- The name stays empty: the identity provider does not send the name attributes. Sign-in still works, since only the email address is mandatory.
- Sign-in breaks after a certificate rotation: this only happens when we registered an XML file instead of a metadata URL. Send us the new file, or switch to the URL.
We answer setup questions directly. Security and privacy material, including the pre-filled questionnaires, is available on the trust page.
To the trust page