Single sign-on and directory sync for teams

On Short Leash Pro for Teams, a team's owners can have its people sign in through the company's identity provider, and, if the provider does it, add and remove them with its directory. It's in your account under Team › Signing in › Single sign-on, and it's included in Teams at no extra cost.

There are three steps: your email domains, your identity provider, and, optionally, your directory. Then choose how people sign in.

1. Verify your email domains

Add each domain your company's email uses, like example.com. Short Leash shows a TXT record to add to that domain's DNS, on _shortleash.example.com, then choose Check. DNS changes can take a few minutes to show.

Only people with an email on a verified domain sign in through your identity provider. A domain is verified for one team at a time. Short Leash checks the record each day: if it's gone for two weeks, the domain stops being verified, and the team's owners get an email first.

2. Connect your identity provider

Short Leash signs people in with SAML 2.0. In your identity provider, add Short Leash as a SAML app with the details on the Single sign-on page:

Short Leash shows	Your provider may call it
Entity ID	Audience URI, Identifier, SP entity ID
Reply URL	Assertion consumer service (ACS) URL, Single sign-on URL
Sign-in URL, for a dashboard tile	Sign on URL, Start URL

Send the person's email as the NameID (in email format) or as an attribute called email, and, if you like, their name as firstName and lastName (or name). Then copy your provider's metadata XML and paste it on the Single sign-on page, or upload the file, and choose Test signing in. The provider connects only once your own sign-in through it works, so a mistake never locks anyone out. Changing provider, or its certificate, works the same way: paste the new metadata and test it, and people keep signing in through the old one until then.

Short Leash emails the team's owners a month before the provider's certificate expires.

Okta

In the Okta Admin Console, go to Applications › Applications › Create App Integration, and choose SAML 2.0.
Set Single sign-on URL to Short Leash's Reply URL and Audience URI (SP Entity ID) to its Entity ID. Set Name ID format to EmailAddress and Application username to Email.
Under Attribute Statements, add email (user.email), firstName (user.firstName) and lastName (user.lastName). To give roles from groups, add a Group Attribute Statement called groups.
Finish, then on the app's Sign On tab, open the Metadata URL and save the XML. Paste or upload it in Short Leash.
Assign the app to people or groups, and test signing in.

Microsoft Entra ID

In the Entra admin center, go to Enterprise applications › New application › Create your own application, and choose Integrate any other application you don't find in the gallery.
Under Single sign-on, choose SAML. In Basic SAML Configuration, set Identifier (Entity ID) to Short Leash's Entity ID and Reply URL to its Reply URL.
Attributes & Claims already sends the email address claim, which Short Leash reads before the NameID (Entra's NameID is the user principal name, which often isn't the email). To give roles from groups, add a group claim and choose Cloud-only group display names, so the names match what you map.
Under SAML Certificates, download Federation Metadata XML and upload it in Short Leash.
Assign users and groups, and test signing in.

Google Workspace

In the Google Admin console, go to Apps › Web and mobile apps › Add app › Add custom SAML app.
On the second screen, download the IdP metadata.
Set ACS URL to Short Leash's Reply URL and Entity ID to its Entity ID. Set Name ID format to EMAIL and Name ID to Basic Information › Primary email.
Finish, turn the app on for the people who should have it, and upload the metadata in Short Leash. Google can take a few minutes to make the app available.

Other providers

Any SAML 2.0 provider works if it takes sign-in requests by redirect (HTTP-Redirect binding) and signs its answers. OneLogin, JumpCloud, Ping and others work the same way: give it the details above, send the email, and paste its metadata.

3. Connect your directory (optional)

With SCIM provisioning, people join the team when they're assigned Short Leash in your directory, with the role their groups map to, and leave it when they're unassigned or deactivated: signed out everywhere, their seat taken back and their computers freed. Once the directory has synced, only the people in it can join the team by signing in. Owners are never changed or removed by the directory.

On the Single sign-on page, copy the SCIM base URL and choose Make a token. The token is shown once; making a new one stops the old one working.

Okta: on the app's General tab, turn on SCIM provisioning. On the Provisioning tab, set SCIM connector base URL to the base URL, Unique identifier field for users to userName, choose Push New Users, Push Profile Updates and Push Groups, and set Authentication Mode to HTTP Header with the token. Then, under To App, turn on creating, updating and deactivating users.
Microsoft Entra ID: on the app's Provisioning page, choose Automatic, set Tenant URL to the base URL and Secret Token to the token, then Test Connection and Start provisioning. Entra syncs about every 40 minutes.
Google Workspace doesn't provision custom SAML apps, so people join the first time they sign in.

Require single sign-on makes it the only way in for emails on your verified domains: someone signed in another way is signed out and sent to your provider. The team's owners keep their password and two-factor authentication, in case the provider is down. You can turn it on once a domain is verified and a test sign-in has worked.
Joining role is the role someone gets the first time they sign in, or are added by your directory.
Directory groups give a role instead, by the group's name, from the directory or the groups your provider sends; the highest one wins.

People choose Sign in with single sign-on on the sign-in page and type their work email, or open Short Leash from their provider's dashboard. Each setup change, sign-in and directory change is in the team's audit log.

Short Leash doesn't sign people out of your provider when they sign out here (single logout), and doesn't sign in with OpenID Connect.