Reference
All URLs are on your workspace: https://<workspace>.waxell.dev.
Custom domains. If your workspace is served on your own domain, the SSO URLs
your IdP is registered against stay on <workspace>.waxell.dev. Someone who
starts on your domain is taken through sign-in on that address and handed back
to your domain afterwards, including after an MFA code. A failed sign-in also
returns them to your domain's login page.
<slug> is the provider's slug.
URLs
| Purpose | Path |
|---|---|
| Login page | /login |
| Start SSO (what Continue with SSO calls) | /api/waxell/v1/auth/sso/<slug>/ |
| Find a provider for an email | /api/waxell/v1/auth/sso/discover/?email=<email> |
| OIDC redirect URI | /api/waxell/v1/auth/sso/callback/ |
| SAML ACS (HTTP-POST) | /api/waxell/v1/auth/saml/acs/<slug>/ |
| SAML SP entity ID and metadata | /api/waxell/v1/auth/saml/metadata/<slug>/ |
| SCIM base | /api/scim/v2/ |
| Google directory OAuth redirect | /api/v1/identity/directory/oauth/callback/ |
| Owner recovery: request | /api/waxell/v1/auth/sso/break-glass/ |
Workspace settings
Set under Settings → Identity.
| Setting | Notes |
|---|---|
| Require single sign-on for everyone | Passwords and social sign-in are refused for every member. Needs an enabled OIDC or SAML provider. See enforcing SSO. Off by default. |
| Require two-factor authentication | See MFA. |
| Network access | Restrict the workspace, login page included, to listed networks. |
Provider settings
Set under Settings → Identity.
| Setting | Notes |
|---|---|
| Name | Shown on the provider list |
| Slug | Used in URLs. Can't be changed after creation. |
| Protocol | OIDC or SAML 2.0. Can't be changed after creation. |
| Issuer URL, Client ID, Client secret, Scopes | OIDC. Scopes default to openid email profile. |
| IdP entity ID, IdP SSO URL, Signing certificate | SAML |
| Email domains | Routes these domains to this provider, and limits who it accepts |
| Group claim, Group mappings | Group → role / team / surface. See group mapping |
| Default role and team | Both slugs; both or neither |
| Create accounts on first sign-in | See account creation. Off by default. |
| Surface for new people | See account creation. Same as an invite by default. |
| Accept the IdP's MFA | See MFA. Off by default. |
| Allow sign-in from the IdP's app launcher | SAML IdP-initiated sign-in. Off by default. |
| Enforce SSO | Require SSO for this provider's email domains. See enforcing SSO. Off by default. |
| Enabled | The provider is only used when this is on |
| SCIM token | Generated per provider, shown once |
Limits and behaviour
- A sign-in must complete within 10 minutes of clicking Continue with SSO.
- Owner recovery links last 15 minutes, then allow 15 minutes of password sign-in.
- SAML assertions must be signed. Waxell doesn't sign AuthnRequests.
- OIDC requires
email_verified: true. - Group values are split on spaces and commas.