SSO with SAML and OIDC

SSH Bridge can use company single sign-on so team members authenticate through your identity provider instead of managing separate SSH Bridge passwords.

Supported Protocols

SSO supports SAML and OIDC providers. Common providers include Google Workspace, Microsoft Entra ID, Okta, Auth0, OneLogin, and other standards-based identity platforms.

Verified Company Domains

A company domain should be verified before SSO is enforced. Domain verification helps SSH Bridge match company worker accounts to the right organization and prevents accidental access from personal email domains.

Required SSH Bridge URLs

The Company settings screen shows the provider-specific URLs after a provider exists. The URL format is:

• SAML ACS URL — https://api.sshbridge.com/api/auth/sso/saml/callback/<providerId>
• SAML SP Entity ID / Metadata URL — https://api.sshbridge.com/api/auth/sso/saml/metadata/<providerId>
• OIDC Redirect URI — https://api.sshbridge.com/api/auth/sso/oidc/callback/<providerId>

If your deployment uses a custom API domain, replace https://api.sshbridge.com/api with your configured public API URL. Always copy the final URL from Settings > Company > SSO Providers when it is available.

Company Worker Accounts

After SSO is configured, company workers can sign in with the configured identity provider. Owners and admins can manage access using team roles, invitations, and plan limits.

Before You Start

1. Make sure your plan includes SSO.
2. Open Settings > Company.
3. Create or save your company name.
4. Add your company email domain, for example example.com.
5. Create the TXT record shown by SSH Bridge.
6. Click Verify after DNS has propagated.

SAML Setup

1. In SSH Bridge, go to Settings > Company > SSO Providers.
2. Choose SAML as the provider type.
3. Enter a provider name such as Google Workspace, Okta, or Microsoft Entra ID.
4. In your identity provider, create a new SAML application for SSH Bridge.
5. Set the SAML ACS URL to https://api.sshbridge.com/api/auth/sso/saml/callback/<providerId>.
6. Set the SAML Entity ID or Audience URI to https://api.sshbridge.com/api/auth/sso/saml/metadata/<providerId>.
7. Configure the Name ID format as email address when your provider asks for it.
8. Make sure the SAML assertion includes the user's email address. SSH Bridge uses the email domain to match the worker to the verified company domain.
9. Copy the provider's Entity ID, SSO URL, and X.509 certificate into SSH Bridge.
10. Click Test Provider.
11. After the test passes, click Save Tested Provider.
12. Use an account from the verified company domain to test sign-in before inviting the wider team.

OIDC Setup

1. In SSH Bridge, go to Settings > Company > SSO Providers.
2. Choose OIDC as the provider type.
3. Enter a provider name such as Google Workspace, Okta, Auth0, or Microsoft Entra ID.
4. In your identity provider, create a new OIDC or OAuth application for SSH Bridge.
5. Set the redirect URI to https://api.sshbridge.com/api/auth/sso/oidc/callback/<providerId>.
6. Copy the provider issuer URL into SSH Bridge. Examples include https://accounts.google.com or your provider's tenant issuer URL.
7. Copy the OIDC client ID and client secret into SSH Bridge.
8. Use scopes openid email profile unless your identity provider requires a different compatible scope set.
9. Click Test Provider. SSH Bridge checks the provider's OIDC discovery document.
10. After the test passes, click Save Tested Provider.
11. Use an account from the verified company domain to test sign-in before inviting the wider team.

How Users Sign In

1. The worker opens the SSH Bridge login page.
2. They enter an email address that belongs to your verified company domain.
3. SSH Bridge discovers the active SSO provider for that domain.
4. The worker is redirected to the identity provider.
5. After successful SSO, SSH Bridge creates or updates the company worker account and applies company access rules.

Require SSO

When Require SSO is enabled, company worker accounts must use company SSO instead of password login. Keep at least one owner or admin account tested before enforcing this for the full company.

Troubleshooting

• Domain will not verify: confirm the TXT record value exactly matches the value shown in SSH Bridge and wait for DNS propagation.
• OIDC test fails: confirm the issuer URL is correct and exposes /.well-known/openid-configuration.
• SAML login fails: confirm the ACS URL, SP Entity ID, SSO URL, certificate, and email attribute are configured correctly.
• User is not matched to company: confirm the user's email domain matches a verified company domain.

Access Control

SSO controls authentication. SSH Bridge team roles and project resource grants still control what each person can see or use after they sign in.