Connect an Identity Provider (IdP)

Connect an external Identity Provider (IdP) to Sift for single sign-on (SSO) authentication and automatic user provisioning. SSO lets users authenticate through your IdP instead of a separate Sift password. System for Cross-domain Identity Management (SCIM) provisioning keeps User accounts and Groups synchronized between your IdP and Sift.

​

Before you begin

• You have contacted your Sift account representative to enable IdP features for your Sift Organization.
• Your Sift User account belongs to a Group with the Admin role. Only Admins can configure SSO.
• Your IdP supports OpenID Connect (OIDC) or Security Assertion Markup Language (SAML) for SSO, and optionally push-based SCIM provisioning.

​

Configure single sign-on (SSO)

SSO supports the OIDC and SAML protocols. Sift saves each new provider as an inactive draft, so you can test sign-in before you turn on SSO for all users.

1. Select your profile icon, and then select Manage.
2. Select Single Sign-On.
3. Select Add provider.
4. In Protocol, select OIDC or SAML. The default is OIDC.
5. Enter an Alias and, optionally, a Display name. The alias is part of the redirect URI that you register with your IdP, so you cannot change it later.
6. Enter your IdP settings:
   • OIDC: Enter the App/Client ID and Client secret. Enter a Discovery URL to import the provider endpoints, or leave it blank and enter the Authorization URL, Token URL, and JWKS URL (JSON Web Key Set) manually.
   • SAML: Enter the Metadata URL.
7. Select Create.
8. Register Sift with your IdP:
   • OIDC: Copy the Redirect URI and register it with your IdP.
   • SAML: Copy the values under Sift registration values (Sift Entity ID, Sift ACS / Reply URL, Sift Logout URL, and Sift SP Metadata URL) and enter them in your IdP.
9. In the Test login section, open the test login URL in a private browser window and sign in through your IdP. A successful test displays the SSO test succeeded page.
10. Select Activate, and then confirm.

Only one SSO provider can be active at a time. Activating a provider deactivates the previously active provider, which stays as a draft. Select Deactivate to stop routing users to a provider while keeping its configuration. Select Delete to permanently delete an inactive provider; deactivate an active provider before you delete it.

​

Configure SCIM provisioning

Sift connects to your IdP using SCIM, a standard protocol for automating user and group provisioning. To connect your IdP, you need two credentials from Sift:

• An access token: used to authenticate those requests
• A SCIM endpoint URL: the address your IdP sends provisioning requests to

Once connected, Sift synchronizes with your IdP automatically every 24 hours. Administrators can also trigger a manual sync at any time. Groups synchronized from an IdP are called external groups in Sift. Their membership and attributes remain controlled by the IdP, though permissions can be managed in Sift.

​

Generate SCIM credentials

1. Click your profile icon.
2. Select Manage.
3. Click Manage Identity Provider.
4. Click Generate Token to generate an access token for IdP verification.
5. In the SCIM Server URL section, click Copy to copy the SCIM endpoint URL.
6. Use the token and SCIM URL to configure your IdP.

​

Synchronize your organization manually

Trigger a manual sync to apply changes from your IdP to Sift without waiting for the next automatic sync.

1. Click your profile icon.
2. Select Manage.
3. Click Manage Identity Provider.
4. Click Sync Organization.

​

View token history

View the history of generated tokens used for IdP verification.

1. Click your profile icon.
2. Select Manage.
3. Click Manage Identity Provider.
4. Click Open.

​

Next steps

• Integrate an Identity Provider with Sift: Learn how to integrate an external IdP with Sift using Microsoft Entra ID as an example, with steps that apply to any IdP that supports push provisioning.

​

Reference

• Identity Provider settings