> ## Documentation Index
> Fetch the complete documentation index at: https://docs.summand.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Other identity providers

> Connect any standards-compliant SAML 2.0 or OIDC IdP — OneLogin, JumpCloud, Auth0, Ping, custom — via the WorkOS Admin Portal.

Summand supports any IdP supported by [WorkOS](https://workos.com). The WorkOS Admin Portal is the configuration surface; Summand opens it for you from organization settings.

## IdPs with first-class WorkOS support

Beyond Okta, Entra, and Google Workspace (which have their own pages), WorkOS ships preset wizards for:

* **OneLogin** (SAML, OIDC, SCIM)
* **JumpCloud** (SAML, SCIM)
* **Auth0** (OIDC)
* **Ping Identity** (SAML)
* **Duo SSO** (SAML)
* **Salesforce** (SAML)
* **VMware Workspace ONE** (SAML)
* **CyberArk Identity** (SAML)
* **Rippling** (SAML, SCIM)
* **BambooHR** (SCIM directory only)

Plus generic **SAML 2.0** and **OIDC** options for anything not in the list — including custom in-house IdPs.

The full, current list lives in WorkOS's [Identity Provider Handbook](https://workos.com/docs/sso/identity-provider-handbook).

## Setup

The flow is identical for every IdP:

<Steps>
  <Step title="Verify your domain">
    **Settings → Organization → Domain Verification → Configure**.
  </Step>

  <Step title="Open the SSO Admin Portal">
    **Settings → Organization → Single Sign-On → Configure**. Pick your IdP from the list.
  </Step>

  <Step title="Configure the IdP side">
    The portal provides the ACS URL / redirect URI / Entity ID, and tells you which attributes to send. Configure the IdP using its own admin UI.
  </Step>

  <Step title="Return metadata to the portal">
    Most IdPs provide a metadata URL or XML download. Paste it; WorkOS validates the certificate and pre-fills.
  </Step>

  <Step title="Test">
    Click *Test connection* in the portal.
  </Step>

  <Step title="(Optional) Directory Sync">
    If your IdP supports SCIM and you want auto-deprovisioning, **Settings → Organization → Directory Sync → Configure** and walk through the SCIM setup.
  </Step>
</Steps>

## Required attributes

Whatever IdP you use, the SAML response (or OIDC ID token) must include:

| Attribute                               | Required | Purpose                      |
| --------------------------------------- | -------- | ---------------------------- |
| `email`                                 | ✓        | Primary identifier           |
| `name`, or `given_name` + `family_name` | ✓        | Display name                 |
| `groups`                                | optional | For group-based role mapping |

Summand-side mapping happens inside the WorkOS portal — you can rename source attributes and bind groups to roles without touching the IdP again.

## Custom in-house IdPs

If you run your own SAML or OIDC provider:

* For **SAML**, use the **Generic SAML** option in the WorkOS portal. Provide your IdP's metadata URL or paste the SSO URL, Entity ID, and X.509 certificate manually.
* For **OIDC**, use the **Generic OIDC** option. Provide the issuer URL, client ID, and client secret. Required scopes: `openid`, `email`, `profile`.

WorkOS handles RelayState, encrypted assertions, and standard SAML signing patterns. For unusual setups (e.g. signed authn requests with a custom signing key), contact [support@summand.com](mailto:support@summand.com) — Enterprise customers can request a guided integration session.

## What if my IdP isn't supported?

If WorkOS doesn't support your IdP and the generic SAML / OIDC paths don't work:

* Most IdPs are reachable through OneLogin or Auth0 as a layer.
* For brand-new IdPs gaining traction, [WorkOS regularly ships new connectors](https://workos.com/changelog) — file a request via Summand support and we'll forward it.
* For air-gapped enterprise deployments, contact sales — we can discuss a private deployment.