SAML SSO is available on the Business plan and above.
How it works
1
Configure your IdP
Register Truthlocks as a service provider (SP) in your identity provider.
You need the SP Entity ID and Assertion Consumer Service (ACS) URL from the
setup screen.
2
Add connection in Truthlocks
In the console, go to Settings > SSO and create a new SAML connection.
Enter your IdP metadata URL or manually provide the IdP entity ID, SSO URL,
and signing certificate.
3
Users sign in via IdP
Once active, users who visit the console login page are redirected to your
IdP. After authenticating, they are returned to Truthlocks with a session.
Service provider details
Provide these values to your IdP when registering Truthlocks:IdP configuration fields
When creating a SAML connection in the console, you can configure your IdP in two ways:Option A: metadata URL
Provide your IdP metadata URL and Truthlocks automatically fetches the entity ID, SSO URL, and signing certificate.Option B: manual configuration
Creating a connection via the API
idp_metadata_url and provide idp_entity_id, idp_sso_url, and idp_certificate instead.
Role mapping
Truthlocks maps IdP group assertions to internal roles during sign-in. Two modes are available:
Set the mode when creating or updating the SSO connection.
User provisioning
When a user authenticates via SAML for the first time, Truthlocks automatically creates their account using attributes from the SAML assertion (email, first name, last name). This is called just-in-time (JIT) provisioning. For bulk user sync and deprovisioning, use SCIM provisioning.Session details
- Sessions last 12 hours after SAML login.
- Session cookies are
HttpOnlyandSameSite=Lax. - A 2-minute clock skew tolerance is applied when validating SAML assertions.
Testing a connection
After creating a SAML connection, test it before enabling for all users:Disabling SSO
To revert to standard email/password authentication:Related
- SCIM provisioning — Automate user and group sync from your IdP.
- RBAC & permissions — Understand the roles that SAML users are mapped to.
- Authentication — API key and JWT authentication methods.