Enterprise SAML SSO

Keiki supports SAML 2.0 single sign-on for your organization. Owners and admins set it up from Settings → Security. SSO is available on qualifying enterprise plans.

Set up SSO

1. Open Settings → Security.
2. Add each company email domain. Publish the TXT value Keiki shows at the domain root, then select Check DNS.
3. Create a setup link and send it to your identity provider administrator. The link expires after 24 hours and works once.
4. On the setup page, download Keiki's SP metadata, or copy the entity ID and ACS URL.
5. Import your identity provider's metadata by URL or XML. To enter it by hand you need the entity ID, the HTTPS SSO URL and the signing certificate.
6. Back in Keiki, test sign-in, activate the connection, pick the default role for new users, and require SSO if you want it.

Requiring SSO only applies to domains you have verified, and owners can always still sign in with a password. SSO sessions last 12 hours.

Okta

1. Create a SAML 2.0 app integration.
2. Import Keiki's SP metadata, or set the Single sign-on URL to the ACS URL and the Audience URI to the SP entity ID.
3. Use EmailAddress for the Name ID format, and the user's email as the application username.
4. Sign assertions with SHA-256. Keiki does not require the response itself to be signed.
5. Assign the users or groups you want.
6. Copy Okta's Identity Provider metadata URL into the Keiki setup page.

Microsoft Entra ID

1. Create an Enterprise application, then choose Set up single sign-on → SAML.
2. Set Identifier (Entity ID) to Keiki's SP entity ID, and Reply URL (ACS URL) to Keiki's ACS URL.
3. Set the unique user identifier to user.mail, or to another claim that always contains the verified work email.
4. Download Federation Metadata XML and paste it into Keiki, or use its metadata URL.
5. Assign users or groups before you test.

Google Workspace

1. In the Admin console, add a Custom SAML app.
2. Download Google's IdP metadata and paste it into Keiki.
3. Enter Keiki's ACS URL and Entity ID.
4. Choose EMAIL as the Name ID format and Primary email as the Name ID.
5. Enable the app for the organizational units or groups you want, then test.

Security

• Sign-in always starts from Keiki.
• Keiki pins the signing certificate you configure.
• Assertions must be signed, and each response must contain exactly one.
• Audience, destination, recipient, timestamps and request correlation are all checked. A used assertion cannot be replayed.
• The asserted email must belong to a domain you have verified.
• IdP metadata must be served over HTTPS from a public address.
• Setup links expire after 24 hours and can be used once.