Single sign-on
Sheetlabs supports SSO via the SAMLv2 standard. Your organisation acts as the identity provider (IdP), and Sheetlabs acts as the service provider (SP).
Configure Sheetlabs
- In Sheetlabs, open Organisation settings.
- Select SSO.
- Copy the Sheetlabs URLs shown on the page.
- In your IdP, create a SAML application in your IdP using those values. This should generate some metadata XML.
- Paste the IdP metadata XML into the SSO page in Sheetlabs.
- Set the email attribute name. The default is
email. - Enable SSO and save.
Sheetlabs provides these SP values which you will need to use to configure your IdP:
| Field | Description |
|---|---|
| Login URL | The Sheetlabs URL users can bookmark for SSO login. |
| ACS URL | The Assertion Consumer Service URL where your IdP posts SAML responses. |
| Entity ID | The Sheetlabs SP entity ID. |
| Metadata URL | Sheetlabs SP metadata for your IdP. |
Force SSO
When Force SSO is enabled, users in your organisation must sign in through your IdP. Sheetlabs password sign-in and password reset are disabled for those users.
API authentication tokens continue to work. Users can view or regenerate their API token from their account page after signing in.
User setup
Create users in Sheetlabs as normal. If SSO is enabled, you can leave the password field blank. If you choose to email sign-in details and Force SSO is enabled, Sheetlabs sends an SSO invitation rather than a password.
The SAML email attribute must match the user's Sheetlabs email address.
Dynamic user creation
Sheetlabs does not create users dynamically from SSO logins. An administrator must create each user in Sheetlabs first, using the same email address that your IdP sends in the SAML response.
Okta installation notes
Create a SAML 2.0 app integration in Okta.
Use the Sheetlabs ACS URL for the Single sign-on URL, and the Sheetlabs Entity ID for the Audience URI. Configure an attribute statement named email with the user's email address, then copy the Okta IdP metadata XML into Sheetlabs.
Microsoft Entra ID installation notes
Create an Enterprise Application and choose SAML single sign-on.
Use the Sheetlabs Entity ID as the Identifier, and the Sheetlabs ACS URL as the Reply URL. Add a claim named email containing the user's email address, then copy the federation metadata XML into Sheetlabs.