Manage users via single sign-on (SSO)

Overview

📌 This article is for Clients — paid plan workspace admins setting up SSO for their organization.

Single sign-on (SSO) is an authentication process that lets users log in to multiple applications and services with one set of credentials, regardless of platform, technology, or domain. Smartcat lets Corporate customers manage their users through their company's SSO provider and supports four major authentication systems: ADFS, Azure AD, Okta, and DUO.

The main benefits of SSO are:

• Secure handling of multiple accounts and related user data

• Stronger security, especially when combined with multi-factor authentication

• A streamlined experience, since removing repeated logins increases employee satisfaction and productivity

• Help enforcing corporate compliance rules

How to set up SSO for your workspace

Smartcat configures SSO on its end. To start, raise a support ticket with the Smartcat support team and provide the following details:

1. The name and software version of your SSO provider — for example, Azure AD, or ADFS 4.0 on MS Server 2016

2. The public URL of your OAuth 2.0 or ADFS server endpoint

3. The OAuth 2.0 server endpoint is the URL where the authorization server is hosted, and where Smartcat sends requests to start authentication

4. The ADFS server endpoint handles authentication, federation, and identity management — for OIDC on Azure or custom OIDC providers you may need to provide multiple endpoints, and for SAML with Azure AD or Entra ID you may also need a certificate

5. The clientId and clientSecret, if applicable — the clientId is the app's public identifier, and the clientSecret is its confidential key

6. The web domain your users' email addresses come from, so they are redirected to your SSO provider

7. A test user email address to verify the configuration

After the support team receives your ticket, Smartcat developers set up SSO and provide callback URLs to add on your server or provider side. Once SSO is connected, users from the specified web domain are redirected to your login URL instead of the Smartcat login form.

Your organization's users now sign in to Smartcat through your own identity provider.

FAQs

What is the process for a user to set up their Smartcat account with SSO?

Users receive an invitation to set up their Smartcat account. During setup, they are redirected to the SSO provider (for example, Okta) for authentication. If authenticated, they are logged in automatically.

What happens if a user is not in the identity provider and tries to log in?

If a user is not in the identity provider (for example, Okta) and tries to log in, they cannot authenticate or access Smartcat. They must exist in the identity provider for SSO to work.

What happens if a user tries to log in without an account in Smartcat?

They are redirected to the sign-up page to finalize registration. Once registered, the user either automatically joins an existing workspace (if domain joining and JIT provisioning are enabled) or can create a new workspace if none is available to join.

Can users create their own workspaces in Smartcat?

Currently users can create their own workspaces, but this is planned for removal. Workspace creation should be managed by admins, and users should be invited to existing workspaces.

Does Smartcat support multiple domains for SSO?

Yes. Domains must be unique and not used by other clients. Provide the list of domains to the Smartcat team for configuration.

What is required to enable SSO for all users in the organization?

Provide the list of domains for federation to the Smartcat team, who update the backend configuration to enable SSO for all users under those domains.

What role do users get when they join a workspace?

Currently users are assigned the Project Manager role by default. This may change in the future to a more limited default role.

Can you test SSO with specific users before enabling it for everyone?

Yes. Provide specific user details to the Smartcat team to test SSO with individual users before full rollout.

Can you use just-in-time (JIT) provisioning?

Yes, provided the necessary security steps are complete on your end. Your workspace must have the setting enabled that lets new users in your domain automatically join the workspace; those users are then provisioned just in time and added as managers. Set up domain joining correctly to maintain security.

Can you assign roles based on group claims or IdP groups?

No. Smartcat does not support role assignment based on group claims or IdP groups. Roles are managed internally using basic user information (ID, email, name, surname).

Does Smartcat provide auditing and logging of actions?

Audit logs can be pulled via API. Smartcat aggregates application logs and traces, but they are not directly available to customers; for investigations, Smartcat can provide internal reports.

Can the system require multi-factor authentication (MFA)?

Yes, MFA can be enforced through SSO.

What SSO claims does the application use?

Make sure your SSO application provides these scopes and claims: openid; scope email with claim email; and scope profile with claims given_name (or firstname) and family_name (or lastname).

Does Smartcat support SCIM user provisioning?

The current SSO implementation does not provide full SCIM capabilities — you manage user data on your IdP, but it is not propagated to Smartcat, and group provisioning is not supported. Smartcat SSO does support automatic provisioning of new accounts on the Smartcat side and lets you deny Smartcat access based on your IdP app's user access list.

What API permissions does the app require?

Smartcat needs permission to read users' profiles and allow sign-in — for Microsoft Graph API these are the profile and User.Read permissions. For Zero Trust policies, configure access rights for users in the Smartcat web portal, since Smartcat cannot perform write operations on the IdP side.

Does the app use a front-channel logout URL?

No, Smartcat does not use a logout URL in its SSO configuration.

Will there be separate instances for integration (DEV, UAT, TEST)?

Not at the moment. Testing takes place in production using test users, after which SSO is enabled for the whole domain.

Does Smartcat support IdP-initiated login attempts?

No.

Does SSO work with the "Sign in with Google" or other third-party options on the login screen?

When SSO is enabled for a paid plan account, its users can only log in through the configured custom SSO. Google and other third-party sign-in options no longer work for those users.

What are the next steps to implement SSO?

1. Provide the list of domains to the Smartcat team

2. Close all workspaces to prevent unauthorized access

3. Set a go-live date and align corporate communications

4. Perform smoke testing to confirm the setup works

What is the process to contact Smartcat support about SSO?

Use the support form, select Smartcat Platform as the Product Area, and choose the SSO request, query, or issue as the Category.