Teams & Enterprise
SSO Setup
Configure Single Sign-On (SAML or OIDC) for your organization.
SSO Setup
SSO allows your team members to sign in to VULK using your organization's identity provider (IdP). VULK supports SAML 2.0 and OIDC protocols.
SSO is available on the Business plan only. Contact support if you need SSO on a different plan.
Supported Protocols
| Protocol | Providers |
|---|---|
| SAML 2.0 | Okta, OneLogin, Azure AD, Google Workspace, any SAML IdP |
| OIDC | Okta, Auth0, Azure AD, Google Workspace, any OIDC provider |
SAML Setup
1. Get VULK Service Provider Details
In Settings > SSO, you will find:
- SP Entity ID:
https://vulk.dev/api/auth/sso/metadata - ACS URL (Assertion Consumer Service):
https://vulk.dev/api/auth/sso/callback - NameID Format: Email address
2. Configure Your IdP
In your identity provider (e.g., Okta, Azure AD):
- Create a new SAML application
- Set the ACS URL and Entity ID from step 1
- Configure NameID to send the user's email address
- Download the IdP metadata or certificate
3. Configure VULK
In Settings > SSO:
- Select SAML as the provider type
- Enter the IdP SSO URL (where VULK redirects users to sign in)
- Paste the IdP certificate (X.509 PEM format)
- Optionally set the IdP Entity ID
- Click Save
4. Verify Your Domain
Add a DNS TXT record to verify you own the email domain:
_vulk-verify.yourdomain.com TXT vulk-verify-xxxxxxxxxxxx5. Test and Activate
Click Test SSO to verify the configuration works. Once verified, toggle SSO to active.
OIDC Setup
1. Register VULK in Your IdP
Create an OIDC application with:
- Redirect URI:
https://vulk.dev/api/auth/sso/callback - Scopes:
openid email profile
2. Configure VULK
In Settings > SSO:
- Select your provider (Okta, Auth0, Azure AD, or Google Workspace)
- Enter the Issuer URL (e.g.,
https://your-org.okta.com) - Enter the Client ID
- Enter the Client Secret (encrypted at rest)
- Click Save
Auto-Provisioning
When enabled, users who authenticate via SSO are automatically:
- Created in VULK (if they don't exist)
- Added to your organization with the default role (Member)
Disable auto-provisioning if you want to manually invite members before they can sign in.
Security
- SAML responses are validated using the
@node-saml/node-samllibrary - XML signatures are verified against the IdP certificate
- Assertion conditions (NotBefore, NotOnOrAfter) are checked
- Audience restriction is enforced
- Client secrets are encrypted with AES-256-GCM
- SSO state tokens use CSRF protection with secure, httpOnly cookies