---
title: "Single Sign-On (SSO) for Project Management | Orangescrum"
description: "Sign in with your existing SAML identity provider or LDAP, and on Self-Hosted use Orangescrum as the identity provider for your wiki and reporting."
canonical: https://www.orangescrum.com/single-sign-on
---

# Single Sign-On (SSO) for Project Management | Orangescrum

> For the complete documentation index, see [llms.txt](https://www.orangescrum.com/llms.txt).

[Home](/) / [Features](/features) / Single Sign-On

Single sign-on

# Single Sign-On That Works _In Both Directions_

Let people into Orangescrum with the identity provider you already run. In the Self-Hosted edition, let Orangescrum be the identity provider for your wiki and your reporting too.

Available in[Cloud](/pricing "Cloud - included")[Self-Hosted](/self-hosted "Self-Hosted - included")Open Source

[Start Free Trial →](/sign-up?utm_source=website&utm_medium=feature&utm_content=single-sign-on)[Book a Demo](https://calendly.com/orangescrum)

Free forever plan · No credit card required · Set up in minutes

## What is single sign-on?

Single sign-on lets somebody use one set of credentials across several applications instead of a separate password for each. Orangescrum works as a SAML 2.0 service provider, so your identity provider can sign people in. The Self-Hosted edition also works the other way round: it runs an OpenID Connect and OAuth2 authorization server, so OS Wiki and OS Reports sign in with Orangescrum credentials, and one logout clears all three.

The problem

## Why access _drifts out of control_

Another password to manage

People keep a separate Orangescrum password, so it gets reused or written down.

✓ Sign in through the identity provider you already run.

Leavers keep working accounts

Someone is disabled in the directory but their project tool login still works.

✓ Access follows the identity provider, so disabling there closes the door.

Roles are set twice

Group membership lives in the directory, and roles are re-entered by hand in the tool.

✓ Map identity provider groups to Orangescrum roles on every sign in.

What you get

## One identity, _across your tools_

Sign in with your provider, or make Orangescrum the provider. Both paths are supported, and they can run together.

-   ### SAML 2.0 sign in
    
    Orangescrum acts as a SAML service provider. Point it at your identity provider, publish its metadata, and people sign in through the provider you already run.
    
-   ### Group to role mapping
    
    Map identity provider groups to Orangescrum roles so a person's role is set on every sign in. Where several groups match, the most privileged role wins. Available in Self-Hosted.
    
-   ### Orangescrum as identity provider
    
    The Self-Hosted edition runs an OpenID Connect and OAuth2 authorization server, so OS Wiki and OS Reports sign in with Orangescrum credentials.
    
-   ### App launcher and single logout
    
    A nine dot launcher in the header switches between Orangescrum, Wiki, and Reports, and one logout chains through all of them. Available in Self-Hosted.
    
-   ### Directory sign in
    
    LDAP and Active Directory sign in, so people authenticate against the directory your organisation already maintains. Available in both editions.
    
-   ### Two factor authentication
    
    Add a second factor to sign in. Available in every edition, including the free Community Edition.
    

How it works

## How to _set it up_

1

Register Orangescrum

Create an application in your identity provider using the Orangescrum service provider metadata URL.

2

Fill in the settings

Paste the issuer, the sign in URL, the logout URL, and the signing certificate into the Orangescrum SSO settings page.

3

Map the groups

In self-hosted, name the group attribute and map each group to an Orangescrum role, with a default for anyone who matches nothing.

4

Sign in and check

Sign in through the provider and confirm the person lands in Orangescrum with the role you expected.

Who it's for

## For organisations with _an identity team_

Enterprises

Joiner and leaver processes that already run through the directory.

[Learn more →](/user-role-management)

Regulated organisations

Sign in you can evidence, on your own servers, including air-gapped networks.

[Learn more →](/self-hosted)

Teams running the full suite

One sign in across Orangescrum, the wiki, and reporting.

[Learn more →](/self-hosted/plugins)

Availability

## Which edition includes _what_

Orangescrum runs as managed cloud, self-hosted on your own servers, or as the open-source Community Edition. Here is exactly what each one includes.

SAML and LDAP sign in are in Cloud and Self-Hosted. The identity provider is Self-Hosted.

| Capability | CloudManaged SaaS | Self-HostedOn-premise / private cloud | Open SourceCommunity Edition |

| SAML 2.0 sign in (Orangescrum as service provider) | Premium | ✓ | ✗ |
| Group to role mapping on sign in | ✗ | ✓ | ✗ |
| OpenID Connect and OAuth2 provider for other apps | ✗ | ✓ | ✗ |
| Nine dot app launcher | ✗ | ✓ | ✗ |
| Single logout across apps | ✗ | ✓ | ✗ |
| LDAP and Active Directory sign in | ✓ | ✓ | ✗ |
| Sign in with Google | ✓ | ✗ | ✗ |
| Two factor authentication | ✓ | ✓ | ✓ |

Frequently asked questions

## Single sign-on _FAQ_

### Does Orangescrum support SSO?

Yes, in both directions. Orangescrum works as a SAML 2.0 service provider, so your identity provider can sign people in. The Self-Hosted edition also runs an OpenID Connect and OAuth2 authorization server, so other applications can sign in with Orangescrum credentials.

### Which identity providers work?

Any provider that speaks SAML 2.0. You supply the issuer, the sign in URL, the logout URL, and the signing certificate, and Orangescrum publishes its own service provider metadata for the provider to consume. Keycloak is documented end to end, including an air-gapped setup.

### Does SSO create accounts for new people?

No. This is the main limitation to plan around. A person must already exist in Orangescrum, matched by email against the identity assertion. If the email is not registered, the sign in is refused with a message rather than creating an account. There is no SCIM or automatic user provisioning in any edition.

### Can identity provider groups set the Orangescrum role?

Yes, in the Self-Hosted edition. Name the group attribute and map each group to a role. Where a person matches several groups the most privileged role wins, and anyone matching nothing gets the default you choose. The Owner role is never granted through SSO, and an existing Owner is never demoted by it.

### Which edition includes what?

SAML and LDAP sign in are available in both Cloud and Self-Hosted, SAML on the Premium plan in Cloud. Group to role mapping, the OpenID Connect provider, the app launcher, and single logout are Self-Hosted only. The free Community Edition has none of these, though it does include two factor authentication.

### What does the OpenID Connect provider actually support?

The authorization code flow with PKCE, and refresh tokens. Scopes are openid, profile, and email. Identity tokens are signed with RS256, refresh tokens rotate and a reused token revokes its whole family, and every authorise, issue, reject, and revoke is written to an audit log.

### Do we still need separate logins for the wiki and reporting?

No, in the Self-Hosted edition. OS Wiki and OS Reports sign in with Orangescrum credentials, a nine dot launcher in the header switches between them, and signing out of Orangescrum chains through both and clears those sessions too.

### Can we run this on a network with no internet access?

Yes, in the Self-Hosted edition. Signature validation is local and the certificate is exchanged once by hand, so no call has to leave your network at sign in time.

## One sign in, across your tools

SAML and LDAP sign in are available in Cloud and Self-Hosted. The identity provider and single logout are part of the Self-Hosted edition.

[Start Free Trial →](/sign-up?utm_source=website&utm_medium=feature&utm_content=single-sign-on_cta)[Book a Demo](https://calendly.com/orangescrum)

## Related capabilities

[User role managementWho can see and change what](/user-role-management)[Self-Hosted editionRun Orangescrum on your own servers](/self-hosted)[Wiki managementSigned in with Orangescrum](/wiki-management)[PricingUnlimited users on every plan](/pricing)