Single Sign-On That Works In Both Directions
Let people into Orangescrum with the identity provider you already run. In the Self-Hosted edition, let Orangescrum be the identity provider for your wiki and your reporting too.
Free forever plan · No credit card required · Set up in minutes
What is single sign-on?
Single sign-on lets somebody use one set of credentials across several applications instead of a separate password for each. Orangescrum works as a SAML 2.0 service provider, so your identity provider can sign people in. The Self-Hosted edition also works the other way round: it runs an OpenID Connect and OAuth2 authorization server, so OS Wiki and OS Reports sign in with Orangescrum credentials, and one logout clears all three.
Why access drifts out of control
One identity, across your tools
SAML 2.0 sign in
Orangescrum acts as a SAML service provider. Point it at your identity provider, publish its metadata, and people sign in through the provider you already run.
Group to role mapping
Map identity provider groups to Orangescrum roles so a person's role is set on every sign in. Where several groups match, the most privileged role wins. Available in Self-Hosted.
Orangescrum as identity provider
The Self-Hosted edition runs an OpenID Connect and OAuth2 authorization server, so OS Wiki and OS Reports sign in with Orangescrum credentials.
App launcher and single logout
A nine dot launcher in the header switches between Orangescrum, Wiki, and Reports, and one logout chains through all of them. Available in Self-Hosted.
Directory sign in
LDAP and Active Directory sign in, so people authenticate against the directory your organisation already maintains. Available in both editions.
Two factor authentication
Add a second factor to sign in. Available in every edition, including the free Community Edition.
How to set it up
For organisations with an identity team
Which edition includes what
| Capability | CloudManaged SaaS | Self-HostedOn-premise / private cloud | Open SourceCommunity Edition |
|---|---|---|---|
| SAML 2.0 sign in (Orangescrum as service provider) | Premium | ✓ | ✗ |
| Group to role mapping on sign in | ✗ | ✓ | ✗ |
| OpenID Connect and OAuth2 provider for other apps | ✗ | ✓ | ✗ |
| Nine dot app launcher | ✗ | ✓ | ✗ |
| Single logout across apps | ✗ | ✓ | ✗ |
| LDAP and Active Directory sign in | ✓ | ✓ | ✗ |
| Sign in with Google | ✓ | ✗ | ✗ |
| Two factor authentication | ✓ | ✓ | ✓ |
Single sign-on FAQ
Does Orangescrum support SSO?
Yes, in both directions. Orangescrum works as a SAML 2.0 service provider, so your identity provider can sign people in. The Self-Hosted edition also runs an OpenID Connect and OAuth2 authorization server, so other applications can sign in with Orangescrum credentials.
Which identity providers work?
Any provider that speaks SAML 2.0. You supply the issuer, the sign in URL, the logout URL, and the signing certificate, and Orangescrum publishes its own service provider metadata for the provider to consume. Keycloak is documented end to end, including an air-gapped setup.
Does SSO create accounts for new people?
No. This is the main limitation to plan around. A person must already exist in Orangescrum, matched by email against the identity assertion. If the email is not registered, the sign in is refused with a message rather than creating an account. There is no SCIM or automatic user provisioning in any edition.
Can identity provider groups set the Orangescrum role?
Yes, in the Self-Hosted edition. Name the group attribute and map each group to a role. Where a person matches several groups the most privileged role wins, and anyone matching nothing gets the default you choose. The Owner role is never granted through SSO, and an existing Owner is never demoted by it.
Which edition includes what?
SAML and LDAP sign in are available in both Cloud and Self-Hosted, SAML on the Premium plan in Cloud. Group to role mapping, the OpenID Connect provider, the app launcher, and single logout are Self-Hosted only. The free Community Edition has none of these, though it does include two factor authentication.
What does the OpenID Connect provider actually support?
The authorization code flow with PKCE, and refresh tokens. Scopes are openid, profile, and email. Identity tokens are signed with RS256, refresh tokens rotate and a reused token revokes its whole family, and every authorise, issue, reject, and revoke is written to an audit log.
Do we still need separate logins for the wiki and reporting?
No, in the Self-Hosted edition. OS Wiki and OS Reports sign in with Orangescrum credentials, a nine dot launcher in the header switches between them, and signing out of Orangescrum chains through both and clears those sessions too.
Can we run this on a network with no internet access?
Yes, in the Self-Hosted edition. Signature validation is local and the certificate is exchanged once by hand, so no call has to leave your network at sign in time.
One sign in, across your tools
SAML and LDAP sign in are available in Cloud and Self-Hosted. The identity provider and single logout are part of the Self-Hosted edition.