SSO is a scalable way to ensure trusted access to your Tines tenant. As security is always a priority at Tines, SSO is available for all Tines tenants. All Tines users can access Tines via their identity provider.
Enabling SSO
To turn SSO on or off for your tenant, go to Authentication Settings in the top left menu and follow the instructions.
Important note: SSO only enables users to sign in, not sign up. Users must be invited to gain access.
SAML configuration
Setting up SSO via SAML requires two pieces of information from your external SAML identity provider (IdP):
A URL, which we’ll redirect users to when signing in.
Your IdP’s X.509 public certificate
While we discourage this for security reasons, you can instead use a fingerprint, which is a digest of the certificate. This must be generated using SHA-256, such as with samltool.com.
Enhanced SAML Security
Tines also supports additional SAML security features, such as encryption and signing. Contact our support team if you'd like to enable these for your tenant.
OIDC configuration
Setting up SSO via OpenID Connect (OIDC) requires six pieces of information from your external OpenID provider (OP):
Your OAuth client ID.
Your OAuth client secret.
The authorization endpoint URL - e.g.
https://accounts.google.com/o/oauth2/v2/authfor Google orhttps://<YOUR-DOMAIN>/oauth2/authorizefor AWS Cognito.The token endpoint URL - e.g.
https://accounts.google.com/o/oauth2/v2/authfor Google orhttps://<YOUR-DOMAIN>/oauth2/tokenfor AWS Cognito.The issuer or issuer identifier URL - e.g.
https://accounts.google.comfor Google orhttps://cognito-idp.<YOUR-REGION>.amazonaws.com/<YOUR-USER-POOL-ID>for AWS Cognito.The JSON Web Key Set (JWKS) URL - e.g.
https://www.googleapis.com/oauth2/v3/certsfor Google orhttps://cognito-idp.<YOUR-REGION>.amazonaws.com/<YOUR-USER-POOL-ID>/.well-known/jwks.jsonfor AWS Cognito.
Items 3 to 6 can be found in your OP’s "provider metadata" or "discovery document", which is normally located at a URL that ends with .well-known/openid-configuration - e.g. https://accounts.google.com/.well-known/openid-configuration for Google or https://cognito-idp.<YOUR-REGION>.amazonaws.com/<YOUR-USER-POOL-ID>/.well-known/openid-configuration for AWS Cognito.
Tines requires that your OP supports the "Authorization code grant" OAuth flow and the "email", "openid" and "profile" OAuth scopes.
Just-in-time user provisioning
With SSO enabled via SAML or OIDC, administrators can optionally enable just-in-time user provisioning. When enabled, administrators can provide a json configuration mapping a group on their SSO identity provider to a Tines team and role.
Once setup, a user signing into Tines for the first time will automatically be placed in the designated team and role mapped to their SSO group in the configuration json without requiring an invitation to the tenant.
Important note: A change to the just-in-time configuration will not update existing users' teams and roles.
To setup just-in-time provisioning:
Enable the checkbox entitled "Enable automatic provisioning of SSO users when first accessing the tenant"
Fill in the following blank fields in the json editor:
The group_attribute_name field should be filled in with the name of the SAML or OIDC attribute containing a user's group name. In the example below the value for this field would be "Group"
An example of a Group Attribute Statement configuration in Okta.
The
tenant_owners_group(optional). When provided, users in the SSO group matching this field will be provisioned as tenant owners.An object in the
mappingsarray containing ansso_groupwith a value matching the name of the desired group in your your identity provider,team_namewith a value matching the name of the Tines team users from this SSO group should be placed into, androle_namewith a value matching the desired team role for those users (team_admin, editor, or viewer).