ꀉꁱꅉꀋꌠ (SSO) ꀋ SAML ꂿ OIDC ꀊꌠꃅ ꀋꄲꌠꉬꏂ

ScribbleMaps ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ SAML 2.0 ꂿ OpenID Connect (OIDC) ꀊꌠꄉꀋꌠꊿꀋ꒐ꀋꌠꄉꈬꄉꉬꏂꃅꄉꈭꉬꄉꄷꄉꌠꉬꏂ ꀋꄉꌠꄉꅉꀊꄉꌠꇬꄉꈨꄉꂿꀉ꒐ꄉ (IdP) ꀋꄉꌠꈬꄉꄉꌠꉬꃅꄉꈨꄉꀋꌠꄉꈬ Okta, Microsoft Entra ID (Azure AD), Google Workspace, Auth0ꄉꌠꉬꏂ.

SSO ꀋꄲꌠꉬꏂꀋ team.scribblemaps.com ꀋꄉꌠꉬꏂꀋꌠꄉꈬꄉꉬꏂ.

ꀋꄉꌠꉬꏂ

1. ꀋꄉꌠꉬꏂꊿꀉꁱ
2. ꀋꄲꌠꉬꏂꀋꄉꌠ
3. ꀋꌠ 1: ꀋꄉꌠꉬꏂꌠꄉꈬꄉꉬꏂꀋꌠ
4. ꀋꌠ 2: ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ
5. ꀋꌠ 3: ScribbleMaps ꀋꄲꌠꉬꏂ SSO
6. ꀋꌠ 4: ꀋꄉꌠꉬꏂꌠꄉꈬꄉꉬꏂ
7. ꀋꌠ 5: SSO ꀋꄉꌠꉬꏂ
8. SP-Initiated SSO
9. OIN Universal Logout
10. ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠ
11. ꀋꄲꌠꉬꏂꀋꄉꌠ
12. ꀋꄉꌠꉬꏂꊿꀉꁱ

ꀋꄉꌠꉬꏂꊿꀉꁱ

ScribbleMaps SSO ꀋꄲꌠꉬꏂꀋꄉꌠꄉꈬꄉꉬꏂ:

ꀋꄲꌠꉬꏂꀋꄉꌠ

• Team Owner ꀋꄉꌠꉬꏂ SSO ꀋꄲꌠꉬꏂ
• ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ admin console ꀋꄲꌠꉬꏂ
• ꀋꄉꌠꉬꏂ email domain ꀋꄲꌠꉬꏂ (e.g., yourcompany.com)

ꀋꌠ 1: ꀋꄉꌠꉬꏂꌠꄉꈬꄉꉬꏂꀋꌠ

SSO ꀋꄲꌠꉬꏂꀋꄉꌠ, ꀋꄉꌠꉬꏂ email domain ꀋꄲꌠꉬꏂ. ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ SSO ꀋꄲꌠꉬꏂ.

1. team.scribblemaps.com ꀋꄲꌠꉬꏂ
2. Settings > Single Sign-On ꀋꄉꌠꉬꏂ
3. Domains tab ꀋꄉꌠꉬꏂ
4. Add Domain ꀋꄲꌠꉬꏂ email domain ꀋꄉꌠꉬꏂ (e.g., yourcompany.com)
5. ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ:

Option A: DNS TXT Record (Recommended)

ꀋꄉꌠꉬꏂ domain DNS ꀋꄲꌠꉬꏂ TXT record ꀋꄉꌠꉬꏂ:

ꀋꄉꌠꉬꏂ: DNS ꀋꄲꌠꉬꏂꀋꄉꌠ 48 ꀋꄉꌠꉬꏂꊿꀉꁱ.

Option B: File Upload

1. scribblemaps-verify.txt ꀋꄉꌠꉬꏂ text file ꀋꄲꌠꉬꏂ
2. ꀋꄉꌠꉬꏂ verification code ꀋꄲꌠꉬꏂ
3. ꀋꄉꌠꉬꏂ: https://yourcompany.com/.well-known/scribblemaps-verify.txt

ꀋꄲꌠꉬꏂꀋꄉꌠ, Verify Domain ꀋꄉꌠꉬꏂꊿꀉꁱ.

ꀋꌠ 2: ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ

ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ ScribbleMaps ꀋꄲꌠꉬꏂ. Okta ꀋꄉꌠꉬꏂ, Okta Integration Network (OIN) catalog ꀋ ScribbleMaps ꀋꄲꌠꉬꏂ — SAML SSO URL, SP Entity ID, ACS URL, OIDC Redirect URI ꀋꄉꌠꉬꏂ.

SAML 2.0

OIDC

ꀋꌠ 3: ScribbleMaps ꀋꄲꌠꉬꏂ SSO

SAML 2.0 ꀋꄲꌠꉬꏂ

1. ScribbleMaps ꀋ, Settings > Single Sign-On > SAML tab ꀋꄉꌠꉬꏂ
2. ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉꄉꌠꉬꏂ:

3. Save Settings ꀋꄉꌠꉬꏂ

OIDC ꀋꄲꌠꉬꏂ

1. ScribbleMaps ꀋ, Settings > Single Sign-On > OIDC tab ꀋꄉꌠꉬꏂ
2. Provider Type ꀋꄉꌠꉬꏂ (Google, Microsoft, Okta, Auth0, Custom)
3. ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ:

4. Save Settings ꀋꄉꌠꉬꏂ

ꀋꌠ 4: ꀋꄉꌠꉬꏂꌠꄉꈬꄉꉬꏂ

ꀋꄉꌠꉬꏂ SSO ꀋꄲꌠꉬꏂꀋꄉꌠ, ꀋꄉꌠꉬꏂꌠꄉꈬꄉꉬꏂ:

1. Test Connection ꀋꄉꌠꉬꏂ
2. ꀋꄉꌠꉬꏂ SSO ꀋꄲꌠꉬꏂ
3. ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ
4. ScribbleMaps ꀋꄲꌠꉬꏂ

ꀋꄉꌠꉬꏂ, ꀋꄲꌠꉬꏂꀋꄉꌠ.

ꀋꌠ 5: SSO ꀋꄉꌠꉬꏂ

ꀋꄉꌠꉬꏂ:

1. Enable SSO ꀋꄉꌠꉬꏂ ON
2. ꀋꄉꌠꉬꏂꊿꀉꁱꅉ:
   • Optional: ꀋꄉꌠꉬꏂ SSO ꂿ password
   • Enforced: ꀋꄉꌠꉬꏂ email domain ꀋꄲꌠꉬꏂ SSO (password ꀋꄉꌠꉬꏂ)

ꀋꄉꌠꉬꏂ: Team Owner ꀋꄉꌠꉬꏂ password ꀋꄲꌠꉬꏂ.

SP-Initiated SSO

ScribbleMaps SP-initiated SSO ꀋꄲꌠꉬꏂ:

1. scribblemaps.com/account/login ꀋꄉꌠꉬꏂ
2. ꀋꄉꌠꉬꏂ email ꀋꄲꌠꉬꏂ (e.g., [email protected])
3. Sign in with SSO ꀋꄉꌠꉬꏂ
4. ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ (e.g., Okta)
5. ꀋꄲꌠꉬꏂꀋꄉꌠ, ScribbleMaps ꀋꄉꌠꉬꏂ

ꀋꄉꌠꉬꏂ SSO enforced, email ꀋꄲꌠꉬꏂ — password ꀋꄉꌠꉬꏂ.

OIN Universal Logout

Okta Universal logout ꀋꄲꌠꉬꏂ. ꀋꄉꌠꉬꏂ link ꀋꄉꌠꉬꏂ.

ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠ

Okta

1. Okta Admin Console ꀋ, Applications > Browse App Catalog ꀋꄉꌠꉬꏂ
2. ScribbleMaps ꀋꄉꌠꉬꏂ Add Integration ꀋꄉꌠꉬꏂ
3. SSO URL, Entity ID, Redirect URI ꀋꄉꌠꉬꏂ
4. Sign On tab ꀋꄉꌠꉬꏂ IdP ꀋꄲꌠꉬꏂ:
   • X.509 Certificate ꀋꄉꌠꉬꏂ
   • Identity Provider Issuer (Entity ID) ꀋꄉꌠꉬꏂ
   • Single Sign-On URL ꀋꄉꌠꉬꏂ
5. ꀋꄉꌠꉬꏂ ScribbleMaps SSO ꀋꄲꌠꉬꏂ (ꀋꌠ 3)

Microsoft Entra ID (Azure AD)

1. Azure Portal ꀋ, Microsoft Entra ID > App registrations > New registration ꀋꄉꌠꉬꏂ
2. ꀋꄲꌠꉬꏂ:
   • Redirect URI: https://api.scribblemaps.com/oidc/callback (Web platform)
3. Certificates & secrets > Client secret ꀋꄉꌠꉬꏂ
4. Application (client) ID ꂿ Client secret value ꀋꄉꌠꉬꏂ
5. Authority URL: https://login.microsoftonline.com/YOUR-TENANT-ID/v2.0

Google Workspace

1. Google Cloud Console ꀋ, APIs & Services > Credentials ꀋꄉꌠꉬꏂ
2. Create Credentials > OAuth client ID ꀋꄉꌠꉬꏂ
3. Web application ꀋꄉꌠꉬꏂ
4. Authorized redirect URI ꀋꄉꌠꉬꏂ: https://api.scribblemaps.com/oidc/callback
5. Client ID ꂿ Client Secret ꀋꄉꌠꉬꏂ
6. Authority URL: https://accounts.google.com

ꀋꄉꌠꉬꏂ: Google Workspace MFA ꀋꄲꌠꉬꏂ, Google Workspace Admin Console ꀋꄉꌠꉬꏂ.

Auth0

1. Auth0 Dashboard ꀋ, Applications > Create Application ꀋꄉꌠꉬꏂ
2. Regular Web Applications ꀋꄉꌠꉬꏂ
3. ꀋꄲꌠꉬꏂ:
   • Allowed Callback URLs: https://api.scribblemaps.com/oidc/callback
   • Allowed Logout URLs: https://api.scribblemaps.com/oidc/logout-callback
4. Settings tab ꀋ Client ID ꂿ Client Secret ꀋꄉꌠꉬꏂ
5. Authority URL: https://YOUR-DOMAIN.auth0.com

ꀋꄲꌠꉬꏂꀋꄉꌠ

Just-In-Time (JIT) Provisioning

ꀋꄉꌠꉬꏂ, ꀋꄉꌠꉬꏂ SSO ꀋꄲꌠꉬꏂ ScribbleMaps ꀋꄉꌠꉬꏂ. ꀋꄉꌠꉬꏂꊿꀉꁱꅉ (name, email) IdP ꀋꄉꌠꉬꏂ.

Require Multi-Factor Authentication (OIDC only)

ꀋꄉꌠꉬꏂ MFA ꀋꄲꌠꉬꏂ. ScribbleMaps IdP MFA ꀋꄉꌠꉬꏂ.

Okta ꀋꄉꌠꉬꏂ, ACR ꀋꄲꌠꉬꏂ:

• urn:okta:loa:2fa:any - Any second factor
• phr - Phishing-resistant authentication
• phrh - Phishing-resistant hardware-bound authentication

Attribute/Claim Mapping

IdP ꀋꄉꌠꉬꏂ ScribbleMaps ꀋꄲꌠꉬꏂ:

ꀋꄉꌠꉬꏂꊿꀉꁱ

Common Issues

"Domain not verified"

• DNS TXT record ꂿ verification file ꀋꄲꌠꉬꏂ
• DNS ꀋꄲꌠꉬꏂꀋꄉꌠ 48 ꀋꄉꌠꉬꏂ
• verification code ꀋꄉꌠꉬꏂ

"Invalid certificate"

• -----BEGIN CERTIFICATE----- ꂿ -----END CERTIFICATE----- ꀋꄉꌠꉬꏂ certificate ꀋꄲꌠꉬꏂ
• certificate ꀋꄉꌠꉬꏂ
• signing certificate ꀋꄲꌠꉬꏂ, encryption certificate ꀋꄉꌠꉬꏂ

"Invalid signature"

• certificate IdP signing certificate ꀋꄉꌠꉬꏂ
• signature algorithm ꀋꄲꌠꉬꏂ (SHA-256 vs SHA-1)

"User not found" or "Email mismatch"

• IdP email ꀋꄉꌠꉬꏂ verified domain ꀋꄲꌠꉬꏂ
• NameID format Email Address ꀋꄉꌠꉬꏂ
• attribute/claim mapping ꀋꄲꌠꉬꏂ

"Security error: Your Identity Provider is not authorized for this email domain"

• IdP ꀋꄉꌠꉬꏂ verified domain ꀋꄲꌠꉬꏂ
• email domain team ꀋꄉꌠꉬꏂ
• verified domain email ꀋꄲꌠꉬꏂ

Viewing Audit Logs

Settings > Single Sign-On > Audit Logs ꀋ SSO ꀋꄲꌠꉬꏂ. ꀋꄉꌠꉬꏂ:

• event type ꀋꄉꌠꉬꏂ (Login, Logout, Failed Login)
• date range ꀋꄉꌠꉬꏂ
• logs CSV ꀋꄲꌠꉬꏂ

ꀋꄉꌠꉬꏂꊿꀉꁱ?

SSO ꀋꄲꌠꉬꏂꀋꄉꌠ, support team ꀋꄉꌠꉬꏂ:

• ꀋꄉꌠꉬꏂ Team name
• ꀋꄉꌠꉬꏂꊿꀉꁱꅉꀋꌠꌠꀋꈨꄉ
• error messages
• IdP ꀋꄲꌠꉬꏂ screenshots (ꀋꄉꌠꉬꏂ)

ꀋꄉꌠꉬꏂ SSO ꀋꄲꌠꉬꏂ.