Enterprise SSO

SSO is available on Enterprise plans only. Contact sales to upgrade.

Single Sign-On (SSO) allows your team members to authenticate using your organization’s identity provider (IdP), providing centralized access management and enhanced security.

Supported Providers

EngageFabric supports two SSO protocols:

SAML 2.0

Industry standard for enterprise SSO. Works with Okta, Azure AD, OneLogin, and more.

OpenID Connect

Modern OAuth 2.0-based protocol. Works with Google Workspace, Auth0, Keycloak, and more.

Setting Up SAML SSO

Step 1: Get Your Service Provider Details

First, retrieve your SAML metadata from the API:

curl -X GET https://api.engagefabric.com/api/v1/enterprise/sso/metadata \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

Response:

{
  "entityId": "https://api.engagefabric.com/api/v1/auth/sso/your-org/metadata",
  "acsUrl": "https://api.engagefabric.com/api/v1/auth/sso/your-org/callback",
  "certificate": "-----BEGIN CERTIFICATE-----\n..."
}

Step 2: Configure Your Identity Provider

Add EngageFabric as a new application in your IdP:

Okta
Azure AD
OneLogin

Go to Applications > Create App Integration
Select SAML 2.0
Enter the following settings:
- Single Sign-On URL: {acsUrl from above}
- Audience URI (SP Entity ID): {entityId from above}
- Name ID Format: EmailAddress
Under Attribute Statements, add:
- email → user.email
- firstName → user.firstName
- lastName → user.lastName
Save and copy the Metadata URL or download the IdP metadata

Go to Enterprise Applications > New Application
Select Create your own application
Choose Integrate any other application (Non-gallery)
Go to Single sign-on > SAML
Enter:
- Identifier (Entity ID): {entityId from above}
- Reply URL (ACS URL): {acsUrl from above}
Download the Federation Metadata XML

Go to Applications > Add App
Search for “SAML Custom Connector (Advanced)”
Configure:
- Audience (EntityID): {entityId from above}
- ACS URL: {acsUrl from above}
Save and download the SAML metadata

Step 3: Configure EngageFabric

Update your SSO configuration with the IdP details:

curl -X PUT https://api.engagefabric.com/api/v1/enterprise/sso \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "SAML",
    "displayName": "Company SSO",
    "samlEntityId": "https://idp.company.com/saml/metadata",
    "samlSsoUrl": "https://idp.company.com/saml/sso",
    "samlCertificate": "-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----",
    "autoProvision": true,
    "defaultRole": "MEMBER",
    "allowedDomains": ["company.com"]
  }'

Setting Up OIDC SSO

Step 1: Create an OAuth Application

In your identity provider, create a new OAuth/OIDC application:

Google Workspace
Auth0
Keycloak

Go to Google Cloud Console
Navigate to APIs & Services > Credentials
Click Create Credentials > OAuth client ID
Select Web application
Add redirect URI: https://api.engagefabric.com/api/v1/auth/sso/your-org/callback
Copy the Client ID and Client Secret

Go to Applications > Create Application
Select Regular Web Applications
In Settings, add Callback URL: https://api.engagefabric.com/api/v1/auth/sso/your-org/callback
Copy the Domain, Client ID, and Client Secret

Create a new Client in your realm
Set Client Protocol to openid-connect
Set Access Type to confidential
Add Valid Redirect URI: https://api.engagefabric.com/api/v1/auth/sso/your-org/callback
Save and go to Credentials tab to copy the secret

Step 2: Configure EngageFabric

curl -X PUT https://api.engagefabric.com/api/v1/enterprise/sso \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "OIDC",
    "displayName": "Company SSO",
    "oidcIssuer": "https://accounts.google.com",
    "oidcClientId": "YOUR_CLIENT_ID",
    "oidcClientSecret": "YOUR_CLIENT_SECRET",
    "oidcScopes": ["openid", "profile", "email"],
    "autoProvision": true,
    "defaultRole": "MEMBER",
    "allowedDomains": ["company.com"]
  }'

Configuration Options

Field	Type	Description
`provider`	string	`SAML` or `OIDC`
`displayName`	string	Friendly name shown on login button
`autoProvision`	boolean	Auto-create users on first login
`defaultRole`	string	Role for auto-provisioned users
`allowedDomains`	array	Restrict to specific email domains

SAML-Specific Fields

Field	Description
`samlEntityId`	IdP Entity ID from metadata
`samlSsoUrl`	IdP SSO endpoint URL
`samlCertificate`	IdP X.509 certificate

OIDC-Specific Fields

Field	Description
`oidcIssuer`	IdP issuer URL (e.g., `https://accounts.google.com`)
`oidcClientId`	OAuth client ID
`oidcClientSecret`	OAuth client secret
`oidcScopes`	Requested scopes (default: `openid`, `profile`, `email`)

Testing Your Configuration

Before enforcing SSO, test that it works correctly:

curl -X POST https://api.engagefabric.com/api/v1/enterprise/sso/test \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

Response:

{
  "valid": true,
  "loginUrl": "https://idp.company.com/saml/sso?SAMLRequest=..."
}

Visit the loginUrl in a browser to test the full SSO flow.

Auto-Provisioning

When autoProvision is enabled:

New users are automatically created on first SSO login
They’re assigned the defaultRole you specified
Their name and email are populated from the IdP
They don’t need a separate invitation

Auto-provisioned users count toward your team member limit. Monitor your usage to avoid exceeding plan limits.

Domain Restrictions

Use allowedDomains to restrict which email domains can authenticate:

{
  "allowedDomains": ["company.com", "subsidiary.com"]
}

Users with email addresses outside these domains will be denied access, even if they successfully authenticate with your IdP.

Disabling SSO

To disable SSO and revert to password authentication:

curl -X DELETE https://api.engagefabric.com/api/v1/enterprise/sso \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

Disabling SSO will require all users to set passwords. Ensure users have password recovery options before disabling.

API Reference

Method	Endpoint	Description
GET	`/v1/enterprise/sso`	Get current SSO configuration
PUT	`/v1/enterprise/sso`	Create or update SSO configuration
DELETE	`/v1/enterprise/sso`	Disable SSO
POST	`/v1/enterprise/sso/test`	Test SSO configuration
GET	`/v1/enterprise/sso/metadata`	Get SAML metadata for IdP setup

Troubleshooting

Users are not being auto-provisioned

Check that:

autoProvision is set to true
The user’s email domain is in allowedDomains (if set)
You haven’t reached your plan’s team member limit

OIDC fails with 'Invalid redirect URI'

Ensure the callback URL in your IdP exactly matches: https://api.engagefabric.com/api/v1/auth/sso/{your-org-slug}/callback

Custom Domains

Configure custom domains for your API and admin console

Team Management

Manage team members and roles

Getting Started

Guides

Core Concepts

API Reference

Endpoints

SDKs

Resources

Supported Providers

SAML 2.0

OpenID Connect

Setting Up SAML SSO

Step 1: Get Your Service Provider Details

Step 2: Configure Your Identity Provider

Step 3: Configure EngageFabric

Setting Up OIDC SSO

Step 1: Create an OAuth Application

Step 2: Configure EngageFabric

Configuration Options

SAML-Specific Fields

OIDC-Specific Fields

Testing Your Configuration

Auto-Provisioning

Domain Restrictions

Disabling SSO

API Reference

Troubleshooting

Custom Domains

Team Management

​Supported Providers

SAML 2.0

OpenID Connect

​Setting Up SAML SSO

​Step 1: Get Your Service Provider Details

​Step 2: Configure Your Identity Provider

​Step 3: Configure EngageFabric

​Setting Up OIDC SSO

​Step 1: Create an OAuth Application

​Step 2: Configure EngageFabric

​Configuration Options

​SAML-Specific Fields

​OIDC-Specific Fields

​Testing Your Configuration

​Auto-Provisioning

​Domain Restrictions

​Disabling SSO

​API Reference

​Troubleshooting

​Related

Custom Domains

Team Management

Supported Providers

Setting Up SAML SSO

Step 1: Get Your Service Provider Details

Step 2: Configure Your Identity Provider

Step 3: Configure EngageFabric

Setting Up OIDC SSO

Step 1: Create an OAuth Application

Step 2: Configure EngageFabric

Configuration Options

SAML-Specific Fields

OIDC-Specific Fields

Testing Your Configuration

Auto-Provisioning

Domain Restrictions

Disabling SSO

API Reference

Troubleshooting

Related