Single sign-on (SSO)

Trebellar supports Single Sign-On (SSO) so your team can log in using your organization’s existing identity provider (IdP), such as Okta, Azure AD, OneLogin, or any standards-based OIDC or SAML provider.

Setting up SSO is entirely self-service: you configure a new app integration with your identity provider, then enter the resulting connection details directly into Trebellar’s SSO settings. There’s no need to email connection details to your account rep or wait for us to complete anything on our end.

Before you start

Make sure you have the following ready:

• Admin access to your identity provider (e.g., Okta, Azure AD, OneLogin).
• Admin access to your Trebellar workspace — needed to enter your identity provider’s connection details and configure SSO login behavior in Settings > Security > SSO. This step is self-service and doesn’t require anything from Trebellar.

What to expect

Here’s the process end to end. Everything happens in your identity provider’s admin console and in Trebellar’s own settings — there’s no back-and-forth with Trebellar required.

1. In Trebellar, go to Settings > Security > SSO and choose OpenID Connect or SAML 2.0.
2. Copy the redirect URI / entity ID values Trebellar shows (already filled in for your org) into a new app integration in your identity provider.
3. Assign the right users or groups to the app.
4. Copy the connection details back from your identity provider — an issuer URL and client credentials for OIDC, or a metadata URL/document for SAML — and paste them into the same Trebellar settings page.
5. For OIDC, optionally click Test Configuration to confirm Trebellar can reach your identity provider. For SAML, pick the Metadata URL, Metadata XML, or Manual entry mode that matches your setup, and — for the Metadata URL/XML modes — click Apply to preview the SSO URL and signing certificate Trebellar reads from it. Then click Save Connection.
6. Configure how you want SSO to handle sign-in for users who don’t yet exist in your org, or turn on SCIM provisioning instead.

Configuration reference

Trebellar supports both OpenID Connect (OIDC) and SAML 2.0. Use whichever your identity provider and internal policy prefer — most customers use OIDC. The values below (with your org’s ID already filled in) are also shown live on the Settings > Security > SSO page, ready to copy.

OIDC

Values to enter in your identity provider:

What you’ll enter in Trebellar:

SAML

Values to enter in your identity provider:

What you’ll enter in Trebellar:

Choose one of the three modes shown in the SAML panel:

Trebellar remembers which mode you used to set up the connection, so reopening the credentials panel later re-selects it automatically.

Setting up your identity provider

In your identity provider’s admin console:

1. Create a new app integration (choose OIDC or SAML, depending on which your organization uses — see Configuration reference above).
2. Enter the redirect URIs and other values listed above for the protocol you’re using. Trebellar’s Settings > Security > SSO page shows the exact values for your org — copy them from there rather than typing the placeholders above by hand.
3. Assign the people or groups who should have SSO access to Trebellar.
4. Save the integration, then collect the connection details you’ll need to enter into Trebellar (see below).

The exact screens and terminology vary by provider — consult your provider’s own documentation for the specific steps. If you’re using Okta specifically, we also have a dedicated Okta setup guide with a full walkthrough.

Connecting to Trebellar

Once your identity provider is configured, go to Settings > Security > SSO in Trebellar, select the matching protocol tab, and enter your connection details:

• OIDC: Issuer URL, Client ID, and Client Secret.
• SAML: choose Metadata URL, Metadata XML, or Manual entry, then enter the corresponding values.

For OIDC, click Test Configuration to confirm Trebellar can resolve your provider’s endpoints before committing. For SAML’s Metadata URL and Metadata XML modes, click Apply instead to preview the IdP single sign-on URL and signing certificate Trebellar reads from the metadata — there’s no separate test step for manual entry, since there’s no metadata to parse. Either way, finish with Save Connection. Your client secret and signing certificate are stored encrypted; Trebellar only ever displays a masked version of the secret afterward.

You can also customize how your SSO button appears on the sign-in page — set a Button label and Icon URL in the same panel. Both default to your organization’s name and avatar if left blank.

Configuring SSO login behavior in Trebellar

After SSO is enabled, you can control what happens when someone signs in through your identity provider but doesn’t already have an account in your Trebellar org. This is configured entirely on your end — no need to involve Trebellar.

To get there:

1. Log into Trebellar with an admin account.
2. Go to Settings > Security > SSO.
3. Choose one of the following options for SSO login behavior.
4. Click Save SSO Settings.

If you’re unsure which option fits your organization, Only existing users is the safest default, and you can change it at any time.

Provisioning users with SCIM

As an alternative to the sign-in behavior above, Trebellar supports SCIM 2.0 so your identity provider can create, update, and deactivate Trebellar users directly, rather than provisioning them on first sign-in.

SCIM setup lives under the SAML tab in Settings > Security > SSO — switch to that tab even if your organization signs in with OIDC. Turn on Provision users with SCIM to reveal:

Click Generate Bearer Token to create the token your identity provider authenticates with, then copy it into your provider’s SCIM app configuration.

Need help?

If you run into any issues while setting up your identity provider or configuring the connection in Trebellar, reach out to your account rep — we’re happy to help at any stage of the process.