Single Sign-On (SSO)

Enterprise SSO lets your organization control access to Infracodebase through your existing identity provider. When SSO is enabled, team members sign in with their corporate credentials instead of creating separate accounts.

Availability

SSO is available on negotiated enterprise plans. Contact your account team to enable SSO for your organization.

Supported protocols

Infracodebase supports enterprise SSO through the following protocols.

• SAML 2.0. Works with identity providers like Okta, Azure AD (Entra ID), OneLogin, and any SAML 2.0 compliant provider.
• OpenID Connect (OIDC). Works with providers that support the OIDC standard.

How it works

Once SSO is configured for your enterprise, team members authenticate through your identity provider instead of using email/password or social login. The flow is straightforward.

1. A user navigates to Infracodebase and clicks "Sign in."
2. They enter their corporate email address.
3. They are redirected to your identity provider (Okta, Azure AD, etc.) to authenticate.
4. After successful authentication, they are redirected back to Infracodebase with access to your enterprise.

Users are automatically mapped to your enterprise based on their verified email domain. Once your domain is verified, new users who authenticate via SSO are provisioned automatically as members, with no individual invites needed. SSO users are never given a separate personal enterprise; they land directly in your organization's enterprise.

Directory provisioning is separate from sign-in. When it is configured, your identity provider sends users, groups, and group membership to Infracodebase before those people sign in.

Verified domains and auto-join

Verified domains are available on enterprise plans and managed by admins under Settings → Security. An enterprise can claim more than one domain, such as a parent company and a subsidiary. Each claim follows the same steps.

1. An admin claims the domain (e.g. company.com).
2. The Infracodebase team verifies ownership with you. Claims do nothing until verified.
3. Once verified, anyone signing in with an email at that domain joins your enterprise automatically with the Member role. Admins can raise individual roles afterward under People & Teams.

Auto-join can be switched off per domain at any time. Turning it off (or removing the claim) stops future automatic joins; existing members keep their membership. Every automatic join is recorded in your enterprise audit log.

If a new user signs in through your SSO before their domain is verified, they'll see a notice asking them to contact their administrator. They won't be placed in an enterprise until the domain is verified or they're invited directly.

Directory provisioning

Enterprise administrators manage the directory connection under Settings > Security. At least one domain on the SSO connection must exactly match a verified enterprise domain before the first import.

Activate SSO and directory sync in Clerk, configure provisioning in your identity provider, then choose Sync directory for the first import. After setup, directory user events update Infracodebase automatically. Administrators can run a manual sync when they need to refresh the full directory.

A saved connection marked Configured means Infracodebase knows which directory belongs to the enterprise. Check the last synced date to confirm when the data was refreshed.

Directory provisioning can add people before they first sign in. They appear on the People page with directory-managed access, and Infracodebase refreshes their profile and membership when they sign in or when the directory synchronizes.

Keep at least one app-managed Owner outside the directory as a recovery owner. Directory sync fails, and provisions no one, while the directory includes an existing Owner who is not yet directory-managed. To move an Owner under directory management, first change that person to Admin, run the sync, then restore the Owner role if they still need it. This prevents a directory change from removing every person who can recover enterprise access.

Groups and roles

Synced groups appear on the People page. Administrators can assign a default enterprise role to a directory group and link the group to one or more Infracodebase teams. Your identity provider continues to own group membership.

Role changes from group mappings take effect when a member next signs in. Removing a mapping returns affected members to the access provided by their remaining grants and verified domain.

Directory groups can be combined with manually managed team members. Removing someone from a directory group removes that source of team access without removing access they still hold directly or through another team.

Deprovisioning

When the identity provider deactivates a person, the next directory event or reconciliation marks the identity as deprovisioned and removes directory-managed access. Infracodebase also reconciles the directory on a schedule and at sign-in, so a missed provider event does not leave the membership active indefinitely.

The People page shows whether a directory identity is Active or Deprovisioned. A deprovisioned person cannot use retained workspace, conversation, or token paths through that identity.

If a deprovisioned person never signed in and has no access outside the directory, Infracodebase removes the unused account automatically. People who previously signed in remain visible as deprovisioned so administrators can understand their access history.

What SSO controls

SSO provides the following controls for your enterprise.

• Authentication is centralized. All sign-ins go through your identity provider. You control password policies, MFA requirements, and session management from one place.
• Access follows directory state. Directory events and reconciliation apply deprovisioning without a separate Infracodebase offboarding workflow.
• Domain verification. Only users with email addresses from your verified domain(s) can access your enterprise.

Setting up SSO

SSO configuration is handled with the Infracodebase team during enterprise onboarding. Provide the following information.

1. Your identity provider type (Okta, Azure AD, etc.)
2. SAML metadata URL or OIDC discovery endpoint
3. The email domains to associate with your enterprise
4. Directory provisioning details when you want users and groups synchronized before sign-in

Your account team will walk you through the setup and verify the connection is working before enabling it for your organization.

Combining SSO with roles

SSO controls who can sign in. Roles control what they can do once signed in. Enterprise administrators can assign roles to manage permissions across the organization, including who can create workspaces, manage rulesets, configure integrations, and view billing.

See Roles and People & Teams for details on permission management.