TigerTrust supports SAML, OIDC, and SCIM so your team can sign in with your existing identity provider and have accounts provisioned automatically. SSO configuration is per workspace and takes effect immediately after you save the provider.
Sso

​
Supported protocols

SAML 2.0

Full IdP-initiated and SP-initiated flows. Attribute mapping, auto-provisioning, and allowed domain enforcement.

OIDC / OAuth 2

Google built-in. Any RFC 6749-compliant OIDC provider can be added.

SCIM 2.0

Auto-provision and deprovision users from Okta, Azure AD, JumpCloud, OneLogin, or any RFC 7644-compliant client.

LDAP

LDAP directory integration with just-in-time provisioning on first login.

​
SAML 2.0

1

Get TigerTrust's SP metadata

Download the metadata from https://app.tigertrust.io/api/auth/saml/metadata. Upload this file to your IdP when creating the SAML application.Key values:
  • Entity ID: https://app.tigertrust.io
  • ACS URL: https://app.tigertrust.io/api/auth/saml/callback
  • NameID format: emailAddress
2

Create the app in your IdP

In Okta: Applications > Create App > SAML 2.0. In Azure AD: Enterprise applications > New application > Non-gallery app. Set the ACS URL and Entity ID from the step above.
3

Enter IdP details in TigerTrust

Go to Settings > SSO > Add provider and select SAML. Enter the IdP entity ID, SSO URL, and X.509 signing certificate. Configure attribute mappings for email, first name, last name, and groups.Enable Auto-provision to create TigerTrust accounts automatically on first login. Set Allowed domains to restrict which email domains can sign in via this provider.
4

Test the connection

Click Test connection. TigerTrust validates the metadata and certificate. A successful test confirms the provider is ready.

​
OIDC / OAuth 2

​
Google (built-in)

Google sign-in is available in every TigerTrust workspace without additional configuration. Members sign in with the Sign in with Google button using their Google Workspace or Gmail account. To restrict Google sign-in to specific domains, go to Settings > SSO > Google and add your allowed domains.

​
Any OIDC provider

Go to Settings > SSO > Add provider and select OIDC. Enter:
  • Issuer URL — the OIDC discovery endpoint base (for example, https://mycorp.okta.com)
  • Client ID and Client secret from your IdP
  • Callback URL — https://app.tigertrust.io/api/auth/oidc/callback
  • Scopes — at minimum openid, profile, email

​
SCIM 2.0 provisioning

SCIM lets your IdP push user creates, updates, and deactivations to TigerTrust automatically.
1

Enable SCIM

Go to Settings > SSO > SCIM and toggle SCIM provisioning on. Choose whether to enable auto-provision (create accounts for new IdP users) and auto-deprovision (revoke access when IdP users are deactivated).
2

Copy the SCIM URL and bearer token

TigerTrust shows the SCIM base URL (https://app.tigertrust.io/scim/v2) and generates a bearer token. Copy both.
3

Configure your IdP

Applications > your app > Provisioning > Integration. Enter the SCIM base URL and bearer token. Enable Create Users, Update User Attributes, and Deactivate Users.

​
SCIM capabilities

OperationBehaviour
Create userProvisions a new TigerTrust account if auto-provision is enabled
Update userSyncs name and email changes
Deactivate / delete userRevokes access; audit history is preserved (users are never hard-deleted)
TigerTrust does not hard-delete users deprovisioned via SCIM. Deprovisioning revokes all access and sessions but preserves the user’s audit trail for compliance purposes.
The API surface for SSO and SCIM management is documented at API Reference.

API keys

For non-human callers, use scoped API keys instead of SSO.

Audit logs

Every SSO login, provision, and deprovision is captured.