SAML SSO and SCIM
Configure Enterprise identity with explicit protocol and provisioning boundaries.
On this page
Prerequisites
Confirm Enterprise SSO entitlement and an administrator account. Keep a recovery path while testing the identity provider. Configure the selected workspace and verify the domains used for SSO discovery.
Configure SAML
In the console’s SSO settings, enter the identity provider’s SAML metadata or supported configuration fields. Download Kastra’s service-provider metadata for the workspace, configure the IdP audience and ACS from that metadata, and test a service-provider-initiated login.
The metadata endpoint is /api/v1/sso/saml/{tenantSlug}/metadata; the login and ACS endpoints use the same tenant slug. The implementation uses SAML 2.0. Do not infer enterprise OIDC support or IdP-initiated SAML support from a generic SSO label.
Configure provisioning
Create a SCIM token in SSO settings and store the value when shown. Configure the IdP’s SCIM base URL as https://api.kastra.ai/api/v1/scim/v2 and authenticate with that token.
The current data plane exposes ServiceProviderConfig and Users list/create/get/replace/patch/delete operations. User deactivation affects membership access. Groups-to-role provisioning is not part of this documented surface.
Appliance access and renewal
On an agreed self-hosted deployment, use the installation’s API origin instead of api.kastra.ai for the SCIM base URL and use its generated SAML metadata. An enabled, configured IdP remains usable by existing active members in all license states, including a downgrade without SSO. New JIT memberships require the current SSO entitlement; configuration writes stay gated and inactive memberships remain blocked. Keep a tested local OWNER recovery account. License and recovery details.
Verify against your IdP
Test domain discovery, login, an existing user, a new user, role defaults, deactivation, and revoked-token behavior. Implementation and route tests are not equivalent to an end-to-end certification for every IdP. Domain verification and assertion configuration must reflect the actual deployment.
Use workspace roles to review resulting permissions and contact Kastra for an enterprise rollout.