SSO and SCIM Setup

Upside supports single sign-on through OpenID Connect (OIDC) and SAML 2.0. We can also support SCIM provisioning for organizations that need automated user lifecycle management.

Before beginning, confirm whether your organization prefers OIDC or SAML and identify the administrator who will configure your identity provider. Upside will send that administrator a secure, organization-specific setup link for the selected protocol.

OpenID Connect (OIDC)

Before you begin

Please identify an identity-provider administrator who can configure an OIDC application and test sign-in with a designated user.

Configuration details

Setting	Value
Sign-in redirect URL	Provided in your organization-specific setup link
IdP-initiated logout / Single Logout redirect	Not currently supported for OIDC
Refresh token support	Not required
Required user attributes	Email address, first name, and last name

SAML 2.0

If your organization prefers SAML 2.0, the organization-specific setup link guides your designated identity-provider administrator through the required application configuration and provides the connection details for your organization.

Please do not use another customer's SAML metadata, setup URL, or configuration values. SAML settings are specific to each organization.

How SSO and SCIM work with Upside

Upside uses your identity provider as the source of truth for authentication and, when SCIM is enabled, user lifecycle management.

For organizations using Okta, the typical configuration uses three groups:

Group	Purpose	SCIM push group	Assigned to the Upside application
Standard users	Members who need ordinary Upside access. Upside maps this group to the standard role.	Yes	Indirectly, through the Access group
Administrators	Members who need administrative Upside access. Upside maps this group to the administrator role.	Yes	Indirectly, through the Access group
Access	Contains the union of the standard-user and administrator groups. It controls who can sign in.	No	Yes

Keeping the Access group separate from the SCIM push groups helps avoid identity-provider assignment and provisioning conflicts. SCIM is optional and, when enabled, keeps user access and role membership aligned with your identity provider.

Your identity team retains control over group membership. Upside works with your designated administrator to map the appropriate groups, validate a test user, and enable the connection.

The exact group names, attribute mappings, and SCIM configuration are confirmed during onboarding because they vary by organization and identity provider.

Getting started

Confirm whether your organization prefers OIDC or SAML.
Identify an identity-provider administrator who can participate in setup and testing.
Upside sends your designated administrator a secure organization-specific setup link for OIDC or SAML.
Prepare the user and role groups your organization intends to use.
Book a setup session with Upside.

Need help?

After reviewing these requirements, book time with our IT team to complete setup and testing:

Schedule an SSO or SCIM setup session