Set Up SAML SSO

Before You Begin

SAML single sign-on (SSO) allows members to access Boardable using credentials managed by your organization’s identity provider (IdP).

Boardable supports Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin, JumpCloud, Ping Identity, Keycloak, and other SAML 2.0-compliant providers.

SAML SSO is available on Pro and Pro Plus plans. To complete the setup, you need:

Administrator access to your Boardable organization
Administrator access to your identity provider
Approximately 20 minutes

Get Boardable’s SAML Details

In Boardable, go toSettings > SAML SSO. (If you don't see the SAML SSO tab, contact customer service to enable it for your organization)
Find the Service Provider (SP) Information section.
Copy the following organization-specific values:

IdP field	Boardable value
Entity ID or Audience URI	`https://app.boardable.com/saml/{organization-id}/metadata`
ACS or Reply URL	`https://app.boardable.com/saml/{organization-id}/acs`
Single Logout URL	`https://app.boardable.com/saml/{organization-id}/sls`
SP Metadata URL	`https://app.boardable.com/saml/{organization-id}/metadata`

Use the values displayed in your account to avoid errors.

Configure Your Identity Provider

Create a SAML 2.0 application in your IdP.
Import Boardable’s SP Metadata URL or enter the Entity ID and ACS URL manually.
Configure the following settings:

Setting	Requirement
NameID	User’s email address
NameID format	`emailAddress`
ACS binding	HTTP-POST
Assertion signing	Required
Signature and digest	RSA-SHA256 and SHA-256

Send the user’s email address as an attribute. First and last names are optional but recommended.
Assign the users or groups that should have access to Boardable.

Boardable recognizes each provider’s standard email, first-name, and last-name attributes. If the email attribute is missing, Boardable can use the NameID when it contains a valid email address.

Important: Create a SAML application, not an OAuth or OpenID Connect application. Boardable rejects unsigned SAML assertions.

Complete the Setup in Boardable

Return to Settings > SAML SSO.
Under Identity Provider (IdP) Configuration, enter:
- Identity Provider Type
- IdP Entity ID, sometimes called the Issuer
- IdP SSO URL, sometimes called the Sign-on or Login URL
- IdP Single Logout URL, if applicable
- IdP X.509 Certificate
Paste the certificate or upload a .pem, .crt, or .cer file.
Select Save Configuration.
Choose your provisioning options:

Option	What it does
Just-in-Time Provisioning	Creates accounts for authorized users who do not already have one
Assign role	Assigns new users the Board Member or Observer role
Update user attributes on login	Updates first and last names using IdP information
Allow password fallback for admins	Lets administrators use their Boardable passwords if the IdP is unavailable

JIT provisioning cannot grant administrator access. We recommend allowing password fallback for administrators during rollout.

Test and Enable SAML SSO

Select Test Configuration to check the certificate, URLs, and required fields.
Resolve any errors found during the test.
Turn on Enable SAML SSO.
If desired, create a Custom URL Slug for a shorter sign-in link: https://app.boardable.com/sso/{your-slug}
Test the sign-in process with a non-administrator account before sharing it with members.

Member Sign-In and Account Access

Members can sign in from:

The Boardable tile in your IdP dashboard
Your custom SSO link
https://app.boardable.com/saml/{organization-id}/login
https://app.boardable.com/saml/login, where they can enter the organization ID

Boardable matches accounts by email address:

Existing organization members are linked to the IdP during their first SSO sign-in.
Users who have a Boardable account but are not members of your organization must be invited before signing in.
New accounts are created automatically only when JIT provisioning is enabled.
Members who use only SSO are directed to the organization’s SSO page instead of receiving a standard password-reset link.

If you configure an IdP Single Logout URL, a signed logout request from your IdP will end the member’s Boardable session. Signing out of Boardable does not sign the member out of the IdP.

Troubleshooting

Issue	Resolution
SSO authentication failed	Confirm the IdP certificate is current and assertion signing is enabled
Audience or recipient mismatch	Copy the Entity ID and ACS URL exactly as shown in Boardable
User is not a member of the organization	Invite the user or enable JIT provisioning for new accounts
Organization ID cannot be found	Copy the organization ID from your Boardable URL
Sign-in link expired	Start again; sign-in handoff links expire after two minutes and cannot be reused
Names are missing	Confirm your IdP sends its standard first-name and last-name attributes
Intermittent signature failures	Confirm your IdP’s clock is synchronized

For additional help, provide Support with your organization ID, IdP type, error message, and the approximate time of the failed attempt. Do not send passwords or private keys.

Questions? Contact your CSM or write to the Support team at support@boardable.com.