Configure Instance SSO¶
Single Sign-On (SSO) allows users to log in to Reemo using their existing company credentials, without the need to manage additional passwords.
This integration improves both security and ease of use, while enabling administrators to enforce authentication and compliance policies in a centralized manner.
Access: verified_user Admin Area > dashboard General > passkey SSO Connectors.
Reemo supports several SSO integration methods:
SAML (Security Assertion Markup Language) is an open standard that allows a service provider (here Reemo) to trust an identity provider for user authentication. This is the most common method for SSO in web applications. Examples of providers: Microsoft Entra ID (Azure AD), Okta, Google Workspace, Auth0.
OIDC (OpenID Connect) is a modern authentication protocol built on top of OAuth 2.0, allowing Reemo to delegate authentication to an identity provider through signed tokens. Examples of providers: Keycloak, Authentik, Microsoft Entra ID (Azure AD), Okta.
LDAP (Lightweight Directory Access Protocol) is a protocol used to query and modify directory services. It is often used for centralized authentication by connecting to an existing company directory. Examples of providers: Microsoft Active Directory, OpenLDAP.
Each method requires specific configuration both in Reemo and on the identity provider side. To set this up, go to the SSO Connectors menu of your instance.
Advanced Options¶
When configuring an SSO connector, advanced options allow you to automate user management and resource assignment:
Just In Time Provisioning¶
Note
When enabling JIT, you will be prompted to choose which organization users will be attached to. Make sure you have created the corresponding organization beforehand. You can always go back and edit your SSO connector later.
Automatic Collection Mapping¶
The Extra Mapping section allows you to define rules to automatically assign users to collections or inside groups, based on attributes returned by the SAML or OIDC identity provider.
Field to map: name of the SAML attribute or OIDC claim (e.g. department, groups, etc.).
Match type: evaluation mode (e.g. REGEX to apply a regular expression).
Expected value: the value or pattern that, when present in the attribute, triggers association with the chosen collection (e.g. internet).
This automates access: a user whose attribute matches the defined rule will automatically be added to the relevant collection.
Example: If the attribute department matches the value internet, the user will automatically be added to the Internet Navigation collection, if that collection has internet as its identifier.
Logout via the Identity Provider¶
Specific to SAML connectors, this option also logs the user out of their identity provider when they log out of Reemo, using two modes:
Redirect to the URL above (default): the browser is redirected to the configured logout URL.
SAML single logout (signed LogoutRequest): Reemo signs a SAML logout request and exchanges with the provider to end its session — the only mode compatible with a provider whose logout endpoint is the same as its login endpoint (e.g. Microsoft Entra ID, Keycloak).
Both fields are optional and backward-compatible: existing connectors keep working without any change. Provider-specific setup details are available in the creation guides below.