Set up single sign-on with any SAML or OpenID Connect provider

Any identity provider that speaks SAML 2.0 or OpenID Connect works with Freesbe, including Keycloak, Auth0, AD FS and Authentik. Look for “custom SAML app”, “generic SAML service provider” or “OpenID Connect web app” in yours.

Before you start

• Single sign-on with your own provider comes with the Corporate and Enterprise plans.
• Verify your company’s email domain in the Admin Center under People → Joining → Email domains (see Let people join with their work email). Your provider can only sign in addresses at a verified domain.
• You need to be an owner of the workspace in Freesbe, and able to add apps in your identity provider.
• Keep the Freesbe page open in one tab and your identity provider in another: you copy details both ways.

1. Start in Freesbe

1. Open the Admin Center: Security → Sign-in & access → Single sign-on.
2. Choose Other SAML or OpenID Connect, then SAML 2.0 or OpenID Connect, then Set up.
3. The page shows Add Freesbe to your identity provider with the details to copy. Leave it open.

2. Add Freesbe to your provider

SAML 2.0: create a SAML app (service provider) and give it:

• Entity ID (audience, SP entity ID): Freesbe’s Entity ID.
• Reply URL (Assertion Consumer Service, ACS): Freesbe’s Reply URL, with the HTTP-POST binding. Or give it Freesbe’s Metadata URL, if it can read one.
• Name ID: the user’s email address (format emailAddress), or an email attribute. A displayName, or givenName and sn, gives new people their name.
• Sign the response or the assertion with SHA-256. Don’t encrypt the assertion.

OpenID Connect: create a confidential web app with the authorization code flow, add Freesbe’s Redirect URL, and allow the openid, email and profile scopes. The ID token needs email. If it also sends email_verified, that has to be true: Freesbe turns away an address your provider hasn’t verified.

Then give the people who use Freesbe access to the app.

3. Tell Freesbe about your provider

• SAML: paste the provider’s metadata URL, upload its metadata file, or choose Enter by hand and enter its issuer (entity ID), sign-in URL (HTTP-Redirect) and signing certificate.
• OpenID Connect: enter the issuer URL (Freesbe reads /.well-known/openid-configuration from it), the client ID and the client secret.

4. Test it

1. Back on the Freesbe page, under Test it, click Test sign-in.
2. Sign in to your identity provider as yourself. You’re brought back to the page, which says Signed in and shows what your identity provider sent: your email address, name and any other attributes.
3. Nobody else can sign in through your identity provider until a test goes through. Once it has, people at your domain choose Sign in with your company’s SSO on the sign-in page.

To make everyone use it, see Require single sign-on for everyone.

If the test doesn’t sign in

The page says why. The usual reasons:

• “isn’t at one of this workspace’s verified email domains”: your identity provider sent an address at another domain, or a username instead of the email. Send the user’s primary email as the name ID or email attribute.
• “isn’t signed with the identity provider’s certificate”: the certificate Freesbe has isn’t the one your identity provider signs with. Paste the metadata URL again, or upload the new metadata file.
• “for another app (Audience)” or “isn’t for this sign-in address”: the entity ID or reply URL in your identity provider doesn’t match Freesbe’s. Copy them again from step 1; they end in /metadata and /acs.
• “is encrypted”: turn off assertion encryption for the Freesbe app.
• The provider shows its own error (often “not assigned”): give yourself access to the Freesbe app in your identity provider.

See Single sign-on for everything else.