Skip to main content

​
What LaunchKit expects from your IdP

  • SP-initiated flows only. Every sign-in starts at LaunchKit (login page or start URL). Unsolicited IdP-initiated responses are rejected, as are replayed assertions.
  • A signed response carrying the member’s email address, plus optional first and last name attributes for nicer provisioning.
  • Your IdP’s entity ID, sign-on URL, and X.509 signing certificate, either as three values or as one metadata XML file.

​
Setup

1

Create the connection in LaunchKit

In the workspace console open Workspace, then Security, choose SAML, and save. You will be asked to re-authenticate. The page now shows your service-provider values (ACS URL and SP metadata URL, unique to this connection).
2

Create the app in your IdP

Create a SAML 2.0 app integration. Set Single sign-on URL to the ACS URL and Audience URI (SP Entity ID) to the SP entity ID from the security page (or import the SP metadata URL). Map email (and optionally firstName, lastName) as attribute statements. Assign your users or groups to the app.
3

Hand the IdP details back to LaunchKit

On the security page, either upload your IdP’s metadata XML (entity ID, sign-on URL, and certificate are extracted automatically) or paste the three values manually. Save.
4

Test, then enable

Open the start URL in a fresh browser session and complete a sign-in through your IdP. When it works, set the connection to enabled. Enforcement is a separate, deliberate step: see Domains and enforcement.
Changing any IdP field (entity ID, sign-on URL, certificate, or the protocol itself) on an enforced connection automatically drops enforcement in the same save. This prevents locking the whole workspace out behind a misconfigured IdP. Re-enforce after you have verified a sign-in against the new configuration.

​
Provisioning behavior

A first-time SSO sign-in creates the member just-in-time with the connection’s default role and consumes a seat. Invited members can also accept an invitation through SSO. Sessions established through SSO satisfy MFA requirements; no second factor is prompted.