> ## Documentation Index
> Fetch the complete documentation index at: https://docs.noclick.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO Setup Guide

> Configure Single Sign-On (SSO) with SAML 2.0 for your organization

# SSO Setup Guide

NoClick supports SAML 2.0 Single Sign-On (SSO) for enterprise organizations. This guide covers setup with popular identity providers including Okta, Azure AD, and others.

## Prerequisites

* A NoClick enterprise account
* Admin access to your identity provider (Okta, Azure AD, etc.)
* Your organization slug from NoClick

## Supported Features

* **SP-Initiated SSO** - Users start login from NoClick and are redirected to your identity provider
* **IdP-Initiated SSO** - Users start login from your identity provider dashboard
* **JIT (Just-In-Time) Provisioning** - User accounts are automatically created in NoClick on first SSO login

## Okta Setup

<Steps>
  <Step title="Add NoClick from App Catalog">
    1. Sign in to your Okta instance as an administrator
    2. Navigate to **Applications** → **Applications** and click **Browse App Catalog**
    3. On the Browse App Integration Catalog page, search for and select **NoClick**
    4. Click **Add Integration**
  </Step>

  <Step title="Get Metadata URL">
    1. Go to the **Sign On** tab of the NoClick application
    2. Copy the **Metadata URL** (looks like `https://your-domain.okta.com/app/.../sso/saml/metadata`)
  </Step>

  <Step title="Configure NoClick">
    1. Log in to NoClick as an organization admin
    2. Go to **Settings** → **Organization** → **SSO**
    3. Paste the Okta Metadata URL
    4. Click **Enable SSO**
  </Step>

  <Step title="Assign Users">
    1. In Okta, go to your NoClick app → **Assignments**
    2. Assign users or groups who should have access
  </Step>
</Steps>

### Supported Attributes

The NoClick OIN application is pre-configured to send the following attributes via SAML assertion:

| Attribute Name | Value            | Description                     |
| -------------- | ---------------- | ------------------------------- |
| `email`        | `user.email`     | User's email address (required) |
| `first_name`   | `user.firstName` | User's first name               |
| `last_name`    | `user.lastName`  | User's last name                |

## Azure AD Setup

<Steps>
  <Step title="Create Enterprise Application">
    1. Go to Azure Portal → **Azure Active Directory**
    2. Select **Enterprise applications** → **New application**
    3. Click **Create your own application**
    4. Name it "NoClick" and select **Integrate any other application (Non-gallery)**
  </Step>

  <Step title="Configure SAML">
    1. Go to **Single sign-on** → Select **SAML**
    2. Edit **Basic SAML Configuration**:

    | Field                  | Value                                               |
    | ---------------------- | --------------------------------------------------- |
    | Identifier (Entity ID) | `https://api.noclick.com/auth/v1/sso/saml/metadata` |
    | Reply URL (ACS URL)    | `https://api.noclick.com/auth/v1/sso/saml/acs`      |
    | Relay State            | `https://noclick.com/auth/callback?next=/dashboard` |
  </Step>

  <Step title="Configure Attributes">
    Edit **Attributes & Claims**:

    | Claim name   | Source attribute |
    | ------------ | ---------------- |
    | `email`      | `user.mail`      |
    | `first_name` | `user.givenname` |
    | `last_name`  | `user.surname`   |
  </Step>

  <Step title="Get Metadata URL">
    In the **SAML Certificates** section, copy the **App Federation Metadata Url**
  </Step>

  <Step title="Configure NoClick">
    1. Log in to NoClick as an organization admin
    2. Go to **Settings** → **Organization** → **SSO**
    3. Paste the Azure AD Metadata URL
    4. Click **Enable SSO**
  </Step>
</Steps>

## Other Identity Providers

For other SAML 2.0 compatible identity providers (OneLogin, Google Workspace, JumpCloud, etc.), use these values:

| Setting                          | Value                                                    |
| -------------------------------- | -------------------------------------------------------- |
| **ACS URL / Single Sign-On URL** | `https://api.noclick.com/auth/v1/sso/saml/acs`           |
| **Entity ID / Audience**         | `https://api.noclick.com/auth/v1/sso/saml/metadata`      |
| **Name ID Format**               | `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` |
| **Default RelayState**           | `https://noclick.com/auth/callback?next=/dashboard`      |

### Required Attributes

| Attribute    | Description                     |
| ------------ | ------------------------------- |
| `email`      | User's email address (required) |
| `first_name` | User's first name (optional)    |
| `last_name`  | User's last name (optional)     |

## Testing SSO

### SP-Initiated Login (Recommended)

1. Go to [noclick.com/auth/sso](https://noclick.com/auth/sso)
2. Enter your organization slug
3. You'll be redirected to your identity provider
4. After authentication, you'll return to NoClick

### IdP-Initiated Login

1. Log in to your identity provider dashboard
2. Click the NoClick app tile
3. You'll be redirected directly to NoClick

<Note>
  IdP-initiated login requires the **Default RelayState** to be configured in your identity provider. Without it, you'll see a "SAML RelayState is not a valid UUID or URL" error.
</Note>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Error: SAML RelayState is not a valid UUID or URL">
    This occurs with IdP-initiated SSO when RelayState isn't configured. Set the **Default RelayState** in your IdP to:

    ```
    https://noclick.com/auth/callback?next=/dashboard
    ```
  </Accordion>

  <Accordion title="Error: User not added to organization">
    Users are automatically added to your organization when they first log in via SSO. Ensure:

    * The user's email domain matches your organization's SSO domain
    * The SSO provider is correctly linked to your organization
  </Accordion>

  <Accordion title="Error: Invalid callback URL">
    Verify the ACS URL in your IdP matches exactly:

    ```
    https://api.noclick.com/auth/v1/sso/saml/acs
    ```
  </Accordion>

  <Accordion title="Error: Audience mismatch">
    Ensure the Entity ID / Audience URI matches:

    ```
    https://api.noclick.com/auth/v1/sso/saml/metadata
    ```
  </Accordion>
</AccordionGroup>

## Support

Need help configuring SSO? Contact us at [support@noclick.com](mailto:support@noclick.com)