Set up workspace single sign-on (SSO)

1. 1

   Ensure you have administrator access to your company's identity provider (like Okta or Auth0) and are a Lovable workspace owner or admin.

   These permissions are necessary to make the required changes in both systems.

2. 2

   Verify your company's domain in Lovable.

   Lovable needs to confirm you own the domain associated with your company's users before setting up SSO.

3. 3

   In Lovable, go to 'Settings' → 'Access' → 'Identity' and click 'Add SSO provider', then choose either 'OIDC' or 'SAML'.

   This starts the SSO setup process and provides you with the Lovable-specific information you'll need for your identity provider.

4. 4

   Follow the specific instructions for your chosen identity provider (Okta, Auth0, or Microsoft Entra ID) and protocol (OIDC or SAML) to configure an application for Lovable.

   Each identity provider has unique steps to create an application and input Lovable's URLs and settings.

5. 5

   Copy the required information (like Issuer URL, Client ID, Client Secret for OIDC, or Metadata URL, SSO Sign-on URL, Entity ID, and X.509 Certificate for SAML) from your identity provider and paste it into the corresponding fields in Lovable.

   This connects your identity provider to Lovable, allowing them to communicate for authentication.

6. 6

   Optionally, update the 'Display name' and 'SSO login identifier (tenant ID)' in Lovable.

   These settings control how the SSO option appears to users and the direct login URL.

7. 7

   Test the configuration in Lovable if the option is available.

   This verifies that the connection between Lovable and your identity provider is working correctly before you finalize the setup.

8. 8

   In Lovable, click 'Configure provider' (or 'Configure SAML provider'), review the confirmation, and then click 'Confirm & enable SSO'.

   This completes the setup and activates SSO for your workspace.

9. 9

   Wait for six hours after enabling SSO, then test an SSO sign-in before turning on 'Enforce SSO' in 'Settings' → 'Access' → 'Identity'.

   This ensures that SSO is working for your users before you make it mandatory, preventing potential lockout issues.

I need to set up Single Sign-On (SSO) for my Lovable workspace. I have admin access to my identity provider and my domain is verified in Lovable. I am a workspace owner. Please guide me through the setup process, starting with selecting the SSO provider type (OIDC or SAML) and then providing the necessary Lovable URLs and identifiers to configure in my identity provider. After that, tell me what information I need to copy from my identity provider back into Lovable to complete the connection.

SSO (Single Sign-On)

A way to log in to multiple applications or websites using just one set of credentials, so you don't have to remember many passwords.

OIDC (OpenID Connect)

A modern standard that allows applications to verify who a user is based on the authentication performed by an identity provider, often used for web and mobile apps.

SAML (Security Assertion Markup Language)

An older, XML-based standard that allows secure exchange of authentication and authorization data between an identity provider and a service provider, commonly used in enterprise environments.

Identity Provider (IdP)

The system that stores user identities and verifies their credentials, like Okta, Auth0, or Microsoft Entra ID.

Service Provider (SP)

The application or service that users are trying to access, which relies on the Identity Provider to authenticate them. In this case, Lovable is the Service Provider.

Tenant ID

A unique identifier for your specific organization or workspace within a service, often used in URLs for direct login.

Redirect URI / Callback URL

A specific web address where the identity provider sends the user back after they successfully log in, ensuring the authentication process is secure.

Issuer URL / Discovery Endpoint

A web address provided by your identity provider that Lovable uses to find all the necessary information to communicate and authenticate users securely.

Client ID / Application ID

A public identifier for the Lovable application registered with your identity provider.

Client Secret

A secret key known only to Lovable and your identity provider, used to securely authenticate the Lovable application itself.

Metadata URL

A web address that provides a file containing all the configuration details (like certificates and endpoints) needed for SAML communication between Lovable and your identity provider.

ACS URL (Assertion Consumer Service URL)

The specific web address on Lovable's side where your identity provider sends the user's authentication information after a successful login.

SP Entity ID / Audience URI

A unique identifier for Lovable that your identity provider uses to confirm it's sending authentication information to the correct service.

X.509 Signing Certificate

A digital certificate used by your identity provider to digitally sign authentication messages, allowing Lovable to verify that the messages are legitimate and haven't been tampered with.

IdP-initiated SSO

A login flow where users start their sign-in process from their identity provider's portal (e.g., clicking an app icon on their company's dashboard).

SP-initiated sign-in

A login flow where users start their sign-in process from the service provider's login page (e.g., going to Lovable's website and clicking 'Log in with SSO').

• Attempting to log in with SSO before linking an existing account will result in an error; always link your account first if you created it with another method.
• Using 'Forgot password?' for SSO-enabled accounts will not work; reset credentials with your identity provider instead.
• Configuring multiple SSO providers for a single workspace is not supported.
• Enforcing SSO without first testing a successful SSO login can lock users out of the workspace.
• IdP-initiated sign-in for SAML will fail if your email domain is verified in more than one Lovable workspace.
• Editing credentials or protocol settings for an existing SSO provider is not possible; you must delete and reconfigure it, which will temporarily disable 'Enforce SSO' and other related settings.