How do I set up SAML SSO with any identity provider?

Any SAML 2.0 identity provider works with Squeezle. Configure it under Admin → Authentication & SSO as an owner or admin. Use the raw values below.

Give your provider these Squeezle values

Set Provider to SAML 2.0 in Squeezle first, so the read-only fields show the exact URLs (each contains your organization's slug). Copy them into your provider's SAML app:

• ACS URL (also called Reply URL or Single sign-on URL) — https://api.squeezle.app/auth/sso/<org-slug>/saml/acs
• SP metadata URL — https://api.squeezle.app/auth/sso/<org-slug>/saml/metadata
• SP Entity ID / Audience URI — the SP entity ID you set in Squeezle (see below)
• ACS binding — HTTP-POST
• NameID format — Email address (persistent is also accepted)

Choose an SP entity ID. Set the SP entity ID field in Squeezle to a stable value and use the exact same string as the Audience / Entity ID in your provider. Using the SP metadata URL as the SP entity ID is a good default. Set it explicitly on both sides; do not leave it blank.

Squeezle publishes service-provider metadata at the SP metadata URL, requires signed assertions (WantAssertionsSigned), and is identity-provider-initiated only: Squeezle does not send an AuthnRequest, so members start sign-in from your provider's app portal.

Paste your provider's values into Squeezle

• IdP SSO URL — your provider's SAML single sign-on / login URL.
• IdP signing certificate (PEM or base64) — the provider's X.509 signing certificate.
• SP entity ID — the value you chose above.
• IdP metadata XML (optional) — leave blank. Squeezle validates with the certificate and SSO URL above, not with uploaded metadata.

Attribute / claim mapping

• email — send it as the NameID (format Email address), or as an attribute named one of: email, mail, emailaddress, emailAddress, or urn:oid:0.9.2342.19200300.100.1.3. If the NameID is an email address, Squeezle uses it as a fallback. Squeezle does not read the AD FS / WS-Federation claim http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, so on AD FS set the NameID to the email address or add a plain email attribute.
• name, groups — not read. Display names come from each member's Squeezle account, and Squeezle does no group-to-role mapping.

Finish and verify

1. Add your company domains under Verified email domains so members are linked by email. Squeezle does not create accounts — invite members first.
2. Turn on Enable SSO sign-in and click Save configuration.
3. Because sign-in is identity-provider-initiated, launch Squeezle from your provider's app portal and confirm you land signed in. If it fails: the member must already be invited to the org, their email domain must be verified, the assertion must be signed, and the provider's Audience must equal Squeezle's SP entity ID.

Then roll out and enforce as in Set up SSO.