SSO and directory synchronisation (SCIM)

If your company already uses an identity provider — such as Microsoft Entra ID, Okta, Keycloak or ADFS — you can connect it to Foral so that people sign in with the credentials they already have and so that accounts are created and kept up to date automatically. These functions are configured in the Settings panel and are reserved for the SUPER_ADMIN role.

Single sign-on (SSO)

With SSO on, every user in the organisation authenticates through your identity provider. Each organisation (tenant) configures one provider, chosen from two protocols:

  • SAML 2.0 — paste your provider’s XML metadata and give its identifier.
  • OIDC (OpenID Connect) — give the provider’s address, the client_id and the client_secret. The rest of the configuration is discovered automatically.

You set it all up in the SSO tab of Settings, with no restart needed. When you save with the option enabled, anyone whose email belongs to the organisation’s domain starts seeing the SSO sign-in button on the entry page.

Conditional access

You can require the provider to confirm a specific authentication method — multi-factor authentication or a smart card, for example. If the provider does not meet that requirement, sign-in is refused.

Directory synchronisation (SCIM)

SSO handles signing in; SCIM handles account management. With SCIM, your provider creates, updates and deactivates users and groups in Foral automatically, without anyone having to do it by hand.

To turn it on, generate a token in the SCIM tab of Settings — the value is shown only once, so keep it somewhere safe. Paste that token, together with the synchronisation address, into the provisioning section of your provider (Entra ID or Okta) and use the option to test the connection.

From then on, synchronisation is continuous:

  • People added in your directory show up in Foral.
  • Changes of name, department or other attributes are propagated.
  • When someone is removed in the directory, the account is suspended (not deleted) — permanent deletion always requires the data transfer, which cannot run on its own.