How to configure SAML or OpenID SSO – Firstbase

Single Sign-On (SSO) lets people in your organization sign in to Firstbase with your company identity provider instead of a separate Firstbase password.

SSO helps you:

Improve security by reducing reliance on separate Firstbase passwords
Simplify access so people use their existing company login
Centralize management of who can sign in from your identity provider (IdP)
Support onboarding and offboarding through your existing access policies

This guide shows how to open the SSO settings page, choose SAML 2.0 or OpenID (OIDC), complete the setup wizard, and manage your connection after it is configured. For identity-provider-specific steps in Azure AD, Google, or Okta, see the guides linked at the end of this article.

Open SSO settings

Sign in to Firstbase.
In the left navigation, go to Settings.
Select Single Sign-on (SSO).

If SSO is not set up yet, you will see a page asking you to choose a protocol. If SSO is already configured, you will see your current connection and options to edit, test, disable, or delete it.

Choose SAML 2.0 or OpenID

On the SSO landing page, pick the protocol your identity provider supports:

SAML 2.0

Common for enterprise identity providers
Uses XML-based authentication
Supports encryption, signing, and attribute mapping

OpenID (OIDC)

Modern protocol built on OAuth 2.0
Uses JSON and ID tokens
Often simpler if your provider already has an OpenID Connect app

You can configure only one SSO connection at a time. Choose the protocol your IT team already uses with Firstbase, or the one your identity provider recommends.

Configure OpenID (OIDC)

On the SSO landing page, select Configure OpenID.
On Client Details, copy the Redirect URI and register it in your identity provider. Then enter your Client ID and Client secret. Optionally turn on signed requests or PKCE, and choose the scopes your provider should share (for example openid, email, and profile).
On Endpoints, paste your discovery URL (if you have one) and select Validate to fill in issuer, authorization, token, and JWKS endpoints automatically. Or enter those HTTPS endpoints manually. The userinfo endpoint is optional.
If your organization does not already have email domains saved, the wizard asks for Email Domains. Add the domains that should sign in through this connection (for example acme.com).
On Review & Enable, confirm the settings and enable SSO.

After setup succeeds, use Test SSO login to confirm sign-in works before rolling it out more widely.

Configure SAML 2.0

On the SSO landing page, select Configure SAML 2.0.
Firstbase creates a draft connection and shows values to register in your identity provider, including the Assertion Consumer Service (ACS) URL and Audience URI. Copy those into your IdP app.
On IDP Metadata, paste your identity provider metadata URL and validate it so Firstbase can fill in settings automatically. Or select Configure manually and continue.
On SAML Protocol, confirm or enter your IdP details: Issuer URI, Single Sign-On URL, and signature certificate (upload a .pem, .cer, .crt, or .cert file if needed). Adjust request binding and signature options only if your IdP requires it.
If your organization does not already have email domains saved, add the Email Domains that should use this SSO connection.
On Review & Enable, confirm the settings and enable SSO.

After setup, you can Download Metadata for your IdP and use Test SSO login to verify the connection.

If you leave mid-setup, finish or abandon the SAML draft before you can start an OpenID configuration.

Manage your SSO connection

After SSO is configured, the SSO page shows your active settings and these actions:

Test SSO login: Opens a sign-in attempt through your identity provider so you can confirm the connection works.
Edit: Update client credentials, endpoints, SAML settings, or related options. For OpenID, leave the client secret blank to keep the existing secret.
Disable: Temporarily turn SSO off. People in your organization sign in with a password until you enable SSO again.
Enable: Turn SSO back on after it was disabled.
Delete: Permanently remove the identity provider connection. This cannot be undone. You will need to configure SSO again from the start.

For SAML, you can also Download Metadata from the configured view when you need Firstbase metadata for your identity provider.

Identity provider setup guides

Use these guides for provider-specific steps in your IdP. Complete the Firstbase side in Settings → Single Sign-on (SSO) whenever that page is available.

If you do not see SSO under Settings, contact support@firstbase.com.

FAQs

Where do I find SSO settings in Firstbase?

Go to Settings, then select Single Sign-on (SSO) in the left navigation.

Should I choose SAML 2.0 or OpenID?

Choose the protocol your identity provider already supports for Firstbase, or the one your IT team standardizes on. SAML 2.0 is common for enterprise IdPs. OpenID (OIDC) is a good fit when your provider offers an OpenID Connect application. Firstbase supports one SSO connection at a time, so pick the protocol you plan to keep.

What email domains should I enter?

Enter the company email domains that should sign in through this SSO connection (for example acme.com). Users with matching email addresses are routed to your identity provider.

If your organization already has email domains saved in Settings, the wizard may skip this step. You can still manage domains under Settings → Email Domains.

Why can’t I configure OpenID while a SAML setup is in progress?

Starting SAML creates a draft identity provider. Firstbase only allows one SSO setup at a time, so OpenID stays unavailable until you finish enabling SAML or abandon the unfinished SAML setup.

How do I test that SSO is working?

On the configured SSO page, select Test SSO login. Firstbase opens a sign-in attempt through your identity provider. Complete login with a user whose email domain matches your SSO domains. If sign-in succeeds, the connection is working.

What happens if I disable SSO?

Disabling turns SSO off for your organization without deleting the configuration. People sign in with a password until you select Enable again. Your IdP settings stay saved, so you can turn SSO back on without repeating the full wizard.

Can I switch from SAML to OpenID (or the other way around)?

Yes, but not while the other protocol is still configured. Delete the existing SSO connection first, then start a new setup with the other protocol from the landing page. Deleting removes the identity provider and cannot be undone.

Why don’t I see the SSO page under Settings?

Self-serve SSO may not be available for your organization yet, or your organization may use a marketplace setup that does not include this Settings page. Contact Firstbase Support if you expect to see SSO and it is missing.