Skip to main content

Setting Up Custom Single-Sign-On (SSO)

Find out how to set up custom SSO for your remberg workspace

Written by Lena Riemensperger

Availability

Packages: Add-on available for Enterprise

User roles: Admin

remberg lets your team sign in through your company's identity provider instead of a separate remberg password. You configure custom SSO connections directly in remberg under Settings → Security → Single Sign-On, without sharing any credentials with remberg Support.

What Are the Options?

  • Microsoft Entra ID (OIDC) – recommended for most Microsoft customers with multiple workspaces or custom policy requirements

  • Microsoft Entra ID (SAML 2.0) – for organizations standardized on SAML

  • Okta (OIDC) – Beta

These options exist in addition to the built-in email/password login with optional two-factor authentication via authenticator apps.

💡 Note: SSO authenticates users solely based on the email address provided by the identity provider. It does not create, sync, or assign roles (no SCIM/user provisioning). Users must already exist in remberg, and their remberg email address must exactly match the email address in the identity provider for SSO login to work.

Which Method, When?

Method

When to Use

Microsoft Entra (OIDC)

Multiple remberg workspaces or custom policy requirements via your own app registration. Self-service.

Microsoft Entra (SAML)

Your organization is standardized on the SAML protocol.

Okta (OIDC)

You use Okta as your identity provider.

💡 Note: Only one custom SSO connection can be active per workspace at a time. The standard Microsoft login runs independently of this.

Before You Start

Make sure you have the following in place:

  • The Custom SSO feature is included in your contract. Check with your Customer Success Manager if the page is missing.

  • Tenant Owner access in remberg with the permission to view and edit passwords.

  • Administrator access to your identity provider (Microsoft Entra admin center or Okta Admin Console).

  • Existing users in remberg. Create or import users before they use SSO, with email addresses that exactly match your identity provider.

Where to find it: Settings → Security → Single Sign-On.

Setup happens in two steps:

  1. remberg shows you values to enter into your identity provider (starting with the redirect URI).

  2. Your identity provider gives you values to enter back into remberg (client ID, secret, issuer, or metadata URL).

💡 Note: Always copy the redirect URI exactly as shown on the Single Sign-On page — it is specific to your environment. In production, it is: https://login.remberg.com/ui/login/login/externalidp/callback

Method 1: Microsoft Entra ID (OIDC)

Recommended for multiple workspaces or custom policy control.

Step 1: Register an Application in Microsoft Entra

  1. In the Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration.

  2. Give it a name (e.g., "remberg SSO").

  3. Under Supported account types, Single tenant is sufficient — remberg connects to your directory via the Directory (Tenant) ID you enter later.

  4. Under Redirect URI, select platform Web and paste the redirect URI from the remberg Single Sign-On page.

  5. Click Register and note the Application (client) ID and the Directory (tenant) ID.

Step 2: Create a Client Secret

  1. Go to Certificates & secrets → + New client secret.

  2. Add a description and an expiration date.

  3. Copy the secret value immediately — Entra only displays it once.

Step 3: Configure Token Claims

  1. Go to Token configuration → + Add optional claim.

  2. Select token type ID.

  3. Add these four claims: email, given_name, family_name, preferred_username.

Step 4: Set API Permissions

  1. Go to API permissions.

  2. Make sure these delegated Microsoft Graph permissions are granted: openid, email, profile, User.Read (openid is usually added automatically).

  3. If user consent is disabled in your organization, click Grant admin consent so users aren't blocked on their first login.

Step 5: Connect in remberg

  1. Open Settings → Security → Single Sign-On and select Microsoft Entra (OIDC).

  2. Enter the Application (client) ID, Directory (tenant) ID, and Client secret.

  3. Click Test connection — this checks the three values against Microsoft without logging anyone in.

  4. Click Set up SSO, then enable SSO active.

Method 2: Microsoft Entra ID (SAML 2.0)

Follow these steps in order — both sides exchange URLs with each other.

Step 1: Create an Enterprise Application in Entra

  1. In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications → New application → Create your own application.

  2. Select Integrate any other application you don't find in the gallery (Non-gallery) and create the application.

  3. Open Single sign-on → SAML.

  4. In the SAML Certificates section, copy the App Federation Metadata URL.

Step 2: Start the Setup in remberg

  1. Open Settings → Security → Single Sign-On and select Microsoft Entra (SAML).

  2. Paste the App Federation Metadata URL and click Set up SSO.

  3. remberg now shows you the Identifier (Entity ID) and Reply URL (ACS URL). Keep this page open.

Step 3: Complete the SAML Configuration in Entra

  1. Edit the Basic SAML Configuration and enter:

  2. Under Attributes & Claims, make sure the application sends nameidentifier and emailaddress.

  3. Under Users and groups, assign the people who should get access.

💡 Note: Email matching is required. remberg reads the emailaddress claim and falls back to the Name ID (the user's UPN) if no mailbox is set up in Entra. Make sure one of these two values contains the user's email address — otherwise login will fail.

Step 4: Activate

Enable SSO active in remberg.

Method 3: Okta (OIDC) (Beta)

Step 1: Create an App Integration in Okta

  1. In the Okta Admin Console, go to Applications → Applications → Create App Integration.

  2. Select OIDC - OpenID Connect, then Web Application.

  3. Give it a name (e.g., "remberg").

  4. Under Sign-in redirect URIs, paste the redirect URI from the remberg Single Sign-On page.

  5. Under Assignments, assign the users or groups who should get access.

  6. Save, then copy the Client ID and Client secret.

Step 2: Check Scopes and Issuer

remberg requests openid, profile, and email. email is required for user matching; the standard OIDC scopes don't require any additional Okta configuration.

Your issuer URL matches your Okta domain, e.g., https://your-org.okta.com.

Step 3: Connect in remberg

  1. Open Settings → Security → Single Sign-On and select Okta (OIDC).

  2. Enter the Issuer URL, Client ID, and Client secret.

  3. Click Set up SSO, then enable SSO active.

How to Verify It Worked

  1. Log out of remberg.

  2. On your workspace's login page, click the Single Sign-On button (or "Login with Microsoft" for the standard option).

  3. You'll be redirected to your identity provider, authenticated, and brought back to remberg.

  4. Check that you're logged in as the correct user with the expected permissions.

💡 Note: The custom SSO button only appears when SSO active is turned on. You can turn it off at any time to hide the button without deleting the configuration.

Important to Know

Users must already exist (no SCIM/provisioning)

Problem: Login fails if the user doesn't yet exist in remberg. Solution: Create or import the user in remberg before they use SSO, with an email address that exactly matches the identity provider's claim.

Secret expiration and rotation (OIDC)

Problem: Client secrets in Entra and Okta expire. If a secret expires, SSO stops working for all users. Solution: Create a new client secret with your provider ahead of the expiration date, open the Single Sign-On page in remberg, enter the new secret, and save. Leaving the field empty keeps the current secret. remberg never stores or displays your secret again after saving.

Switching providers

Only one custom SSO connection can be active at a time. To switch (e.g., from Entra OIDC to Okta), use Remove SSO and then set up the new provider. Removal deactivates the connection and cleans up the identity provider links in the background.

Troubleshooting

Symptom

Likely Cause

Solution

Test connection fails (Entra OIDC)

Incorrect client ID, secret, or tenant ID; expired secret

Check the values; create a new client secret if expired

"Redirect URI mismatch" on login

Redirect URI in the provider doesn't match remberg

Copy the redirect URI from the Single Sign-On page exactly and paste it again

Login succeeds with the provider but not in remberg

User doesn't exist in remberg, or no email in the token

Check that the user exists with a matching email; OIDC: check the email claim/scope; SAML: check emailaddress (or a UPN that is the email)

SAML error AADSTS700016

Entity ID not registered in Entra

Paste the Identifier (Entity ID) from remberg into the Basic SAML Configuration in Entra

SSO button doesn't appear at login

SSO not activated

Turn on SSO active on the Single Sign-On page

Still having issues? Contact remberg Support with your provider type (Entra OIDC / Entra SAML / Okta) and the exact error message.

FAQ

Does SSO automatically create new users in remberg (SCIM)? No. SSO only authenticates existing users. Users must be created or imported in remberg beforehand, with an email address that exactly matches the identity provider.

Can I use multiple custom SSO methods at the same time? No, only one custom SSO connection is active per workspace at a time. The standard Microsoft login runs independently and can be active in parallel.

What happens if the client secret expires? SSO login fails for all users. Create a new secret with your provider before it expires and enter it in remberg.

A user can log in with the identity provider but doesn't make it into remberg — what should I do? Check whether the user already exists in remberg and whether the email address matches exactly. For OIDC, check the email claim/scope; for SAML, check the emailaddress claim (or a UPN that matches the email address).

Related Articles
Did this answer your question?