Single sign-on (SSO)

Single sign-on lets your members open Boldo with the identity provider they already use at work. Boldo supports two protocols:

• SAML 2.0, for example with Okta or Microsoft Entra ID
• OpenID Connect (OIDC), for example with Okta

SSO is set up together with the Boldo team: you create the Boldo application in your identity provider, you send us a few values, and we enable SSO for your organization. It is not a self-service setting.

This page is written for the administrator of your identity provider. To sign in once SSO is enabled, see Log in to Boldo.

How the setup works

1. In your identity provider, create an application for Boldo with the values listed below
2. Assign the members who should have access, including yourself
3. Send us the information listed for your protocol, together with your email domains (for example company.com)
4. Wait for our confirmation: we register your identity provider and link it to your organization
5. Open https://app.boldo.io/sso, enter your organization domain and sign in

Your email domains tell Boldo which identity provider to use when someone signs in from the Boldo SSO page. Subdomains are covered automatically. No DNS verification is needed.

Assign members before the first sign-in

A member who is not assigned to the Boldo application in your identity provider cannot sign in, even after Boldo has enabled SSO.

SAML

Values to configure in your identity provider

Setting	Value
Single sign-on URL, Reply URL, Assertion Consumer Service URL	https://auth.boldo.io/sso/saml/acs
Audience URI, Entity ID, Identifier	https://auth.boldo.io/sso/saml/metadata
Name ID format	EmailAddress
Application username	the member's email address
Signing	Response and assertion signed, RSA-SHA256, assertion not encrypted (usual defaults)

The Name ID must contain the member's email address: it is what identifies the member in Boldo.

Attributes (also called claims or attribute statements):

Name	Value
email	the member's email address
givenName	first name
surname	last name
displayName	display name

With Okta, add these four attributes under Attribute Statements of the application. With Microsoft Entra ID, keep the default claims: Boldo reads them as they are.

What to send to Boldo

• the federation metadata URL of the application (Okta: Sign On tab, Metadata URL; Microsoft Entra ID: App Federation Metadata Url in the SAML certificates section)
• your email domains

Step-by-step guides

• Okta: Applications > Create App Integration > SAML 2.0. Name the application Boldo, enter the values above, finish the wizard, then add the four attributes from the Sign On tab and copy the metadata URL from the same tab. Assign members from the Assignments tab.
• Microsoft Entra ID: Enterprise applications > New application > Create your own application (non-gallery). Open Single sign-on > SAML, enter the Identifier and Reply URL above, copy the App Federation Metadata Url, then assign members from Users and groups.

Detailed guides with screenshots are available from the Boldo team.

OpenID Connect

Values to configure in your identity provider

Setting	Value
Application type	Web application (confidential client)
Grant type	Authorization code
Sign-in redirect URI	https://auth.boldo.io/api/auth/sso/callback
Sign-out redirect URI	not used, leave empty or keep the proposed value
Scopes	openid, profile, email
Claims	sub, email, name (standard claims, nothing to map)

The redirect URI must match exactly: your identity provider refuses the sign-in if a single character differs. Boldo uses PKCE and authenticates to the token endpoint with the client secret.

What to send to Boldo

• your issuer URL, for example https://your-org.okta.com. Boldo reads <issuer>/.well-known/openid-configuration to discover the endpoints and signing keys, so nothing else needs to be copied
• the client ID of the application
• the client secret of the application, through the secure channel we indicate. Never send it by email
• your email domains

If you use a custom authorization server, the issuer looks like https://your-org.okta.com/oauth2/<id>: send that value instead.

Step-by-step guide

• Okta: Applications > Create App Integration > OIDC - OpenID Connect > Web Application. Name the application Boldo, keep Authorization Code, set the sign-in redirect URI above, save, then copy the client ID and client secret from the General tab. Assign members from the Assignments tab.

After the setup

• The first member of your organization to sign in through SSO becomes an Administrator. Everyone after them arrives as a Viewer; adjust their type from Users.
• Members appear in Boldo after their first sign-in, not before.
• To remove a member, remove them from the Boldo application in your identity provider to block their next sign-ins, then remove them from your organization in Boldo.
• Signing out of Boldo does not sign you out of your identity provider, and the reverse is also true.
• With SAML, members can also open Boldo from the Boldo tile of their identity provider portal.
• If you rotate the SAML signing certificate or the OIDC client secret, tell us before the change takes effect: Boldo must be updated on its side, otherwise sign-ins fail.
• To stop using SSO, contact the Boldo team. Deleting the application in your identity provider is not enough.

For how SSO changes access control in an organization, see Security and Users.