Configure SSO¶

Single Sign-On (SSO) allows users to log in to Reemo using their existing company credentials, without having to manage additional passwords.

This integration improves both security and ease of use, while allowing administrators to apply their authentication and compliance policies centrally.

Access: domain Organization > dashboard General > passkey SSO Connectors.

Reemo supports several SSO integration methods:

SAML (Security Assertion Markup Language) is an open standard that allows a service provider (here Reemo) to trust an identity provider to authenticate users. It is the most common method for SSO in web applications. Examples of providers: Microsoft Entra ID (Azure AD), Okta, Google Workspace, Auth0.
OIDC (OpenID Connect) is a modern authentication protocol built on top of OAuth 2.0, allowing Reemo to delegate authentication to an identity provider through signed tokens. Examples of providers: Keycloak, Authentik, Microsoft Entra ID (Azure AD), Okta.
LDAP (Lightweight Directory Access Protocol) is a protocol for querying and modifying directory services. It is often used for centralized authentication by connecting to an existing enterprise directory. Examples of providers: Microsoft Active Directory, OpenLDAP.

Each method requires specific configuration on both the Reemo side and the identity provider side. For this, go to the SSO Connectors menu of your organization.

Advanced Options¶

When configuring an SSO connector, advanced options allow automation of user management and assignment to the right resources:

Just In Time Provisioning¶

By enabling Just In Time Provisioning, users from the SAML or OIDC server are automatically created in Reemo at their first successful login, even if they were not manually added by an administrator.

This greatly simplifies deployment since no prior action is required to provision accounts.

Automatic Collection Mapping¶

The Extra Mapping section allows you to define rules to automatically associate users with collections or inside groups, based on attributes returned by the SAML or OIDC identity provider.

Field to map: name of the SAML attribute or OIDC claim (e.g. department, groups, etc.).
Match type: evaluation mode (e.g. REGEX to apply a regular expression).
Expected value: the value or pattern which, when present in the attribute, triggers association with the chosen collection (e.g. internet).

This enables automated access: a user whose attribute matches the defined rule will automatically be added to the corresponding collection.

Example: If the attribute department matches the value internet, then the user will automatically be added to the Internet Navigation collection if that collection has internet as its identifier.

Logout via the Identity Provider¶

Specific to SAML connectors, this option also logs the user out of their identity provider when they log out of Reemo, using two modes:

Redirect to the URL above (default): the browser is redirected to the configured logout URL.
SAML single logout (signed LogoutRequest): Reemo signs a SAML logout request and exchanges with the provider to end its session — the only mode compatible with a provider whose logout endpoint is the same as its login endpoint (e.g. Microsoft Entra ID, Keycloak).

Both fields are optional and backward-compatible: existing connectors keep working without any change. Provider-specific setup details are available in the creation guides below.