# SAML SSO and SCIM

Configure Enterprise identity with explicit protocol and provisioning boundaries.

Updated: 2026-09-22

Canonical: https://docs.kastra.ai/admin/sso-scim

## Prerequisites

Confirm Enterprise SSO entitlement and an administrator account. Keep a recovery path while testing the identity provider. Configure the selected workspace and verify the domains used for SSO discovery.

## Configure SAML

In the console's SSO settings, enter the identity provider's SAML metadata or supported configuration fields. Download Kastra's service-provider metadata for the workspace, configure the IdP audience and ACS from that metadata, and test a service-provider-initiated login.

The metadata endpoint is `/api/v1/sso/saml/{tenantSlug}/metadata`; the login and ACS endpoints use the same tenant slug. The implementation uses SAML 2.0. Do not infer enterprise OIDC support or IdP-initiated SAML support from a generic SSO label.

## Configure provisioning

Create a SCIM token in SSO settings and store the value when shown. Configure the IdP's SCIM base URL as `https://api.kastra.ai/api/v1/scim/v2` and authenticate with that token.

The current data plane exposes `ServiceProviderConfig` and Users list/create/get/replace/patch/delete operations. User deactivation affects membership access. Groups-to-role provisioning is not part of this documented surface.

## Appliance access and renewal

On an agreed self-hosted deployment, use the installation's API origin instead of `api.kastra.ai` for the SCIM base URL and use its generated SAML metadata. An enabled, configured IdP remains usable by existing active members in all license states, including a downgrade without SSO. New JIT memberships require the current SSO entitlement; configuration writes stay gated and inactive memberships remain blocked. Keep a tested local OWNER recovery account. [License and recovery details](https://docs.kastra.ai/reference/self-hosted).

## Verify against your IdP

Test domain discovery, login, an existing user, a new user, role defaults, deactivation, and revoked-token behavior. Implementation and route tests are not equivalent to an end-to-end certification for every IdP. Domain verification and assertion configuration must reflect the actual deployment.

Use [workspace roles](https://docs.kastra.ai/admin/workspaces) to review resulting permissions and [contact Kastra](https://kastra.ai/contact) for an enterprise rollout.