Enable SAML Single Sign-On

SAML Single Sign-On (SSO) lets your team sign in to Calibre through your organisation’s existing identity provider (SAML IdP) using Okta, Google Workspace, Microsoft Entra ID (Azure AD), OneLogin, or any SAML 2.0 provider.

Before you begin#

To set up SAML you’ll need:

• An Admin role on a Team or Company plan.
• Admin access to your IdP (Okta, Google Workspace, Microsoft Entra ID, OneLogin, or any SAML 2.0 provider).
• To add a DNS TXT record to your domain for verification.

Set up SAML Single Sign-On#

You will get started on the Organisation settings → Authentication page.

Here, you will:

1. Register Calibre in your IdP
2. Add your IdP metadata to Calibre
3. Verify your email domains
4. Test the connection
5. Enable SAML
6. (Optional) Require SSO for everyone
7. (Optional) Allow identity provider sign-in
8. (Optional) Enable SCIM provisioning to automatically create, update and deactivate accounts from your IdP

Step 1: Register Calibre in your IdP#

Log in to your IdP and create a new SAML application for Calibre.

If your IdP supports importing a metadata XML file, click Download metadata and import it into your IdP. If not, copy the ACS URL, Entity ID and Name ID format into your IdP manually.

Step 2: Add your IdP metadata to Calibre#

Lower down the page, in the Connect your identity provider section, you can either import your IdP metadata with a URL, or enter the SSO URL and other details manually if your IdP doesn't support metadata import.

Option A: Import your IdP metadata with a URL. Calibre will import and daily sync metadata from the URL, so you don’t have to worry about certificate rotation ongoing.

Option B: Enter the details manually. You will need:

Then, add your Email domain(s), set the Default user role and Default team.

The default role and team are applied to new users on their first sign-in, whether they are provisioned just-in-time (JIT) or through SCIM.

Click Save configuration. Calibre generates a verification record for each domain you listed.

Step 3: Verify your email domains#

Each domain you listed appears under Verify your domains, marked Pending verification. To prove you own one:

1. Copy the DNS TXT record shown for the domain (it looks like calibre-domain-verification=…).
2. Add it as a TXT record on that domain with your DNS provider.
3. Once DNS has propagated, click Verify domain. Calibre looks up the record and marks the domain Verified.

Step 4: Test the connection#

Click Test connection. Calibre runs a full SAML round-trip and shows the decoded result (Name ID, Name attribute and assertion conditions) with a clear pass or fail.

The test never signs anyone in and never creates an account, so it’s a safe dry run you can repeat as often as you need.

Step 5: Enable SAML#

Once tested and verified, select Enable single sign-on.

SAML sign-in is now live: members sign in with their work email and are redirected to your IdP.

First-time users are created with your default role and team; existing users are linked to SAML on their next sign-in.

(Optional) Require SSO for everyone#

Enabling SAML lets people sign in through your IdP but doesn’t force them to. Choosing the "Require SSO" option enforces SAML-only sign-in for everyone using your account. You can only turn it on once a connection test has passed.

When Require SSO is enabled:

• Everyone signs in through your IdP. Existing accounts are directed through your IdP at sign-in.
• Existing users are linked automatically. People who previously used a password or Google are matched by email on their next SAML sign-in and converted, with no manual migration.
• Manual invitations are turned off. While SSO is required, email invitations are unavailable: everyone is provisioned through your IdP (SAML JIT and/or SCIM).

(Optional) Identity provider sign-in#

By default, people sign in by going to Calibre first. Turn on Identity provider sign-in to also let them start from your IdP’s app launcher or tile. We recommend leaving it off unless your team relies on those app-tile launches.

(Optional) Enable SCIM provisioning#

Enable SCIM from the Provisioning tab of the Authentication screen:

1. Select Enable SCIM provisioning.
2. Copy the SCIM Base URL and bearer token.
3. Paste both into your IdP’s SCIM / provisioning configuration for the Calibre application and enable provisioning.

With SCIM on:

• Accounts are created ahead of first login. Assigning someone to Calibre in your IdP creates their account and organisation membership right away, with the default role and team.
• Provisioning is limited to verified domains. SCIM only creates members whose email is on a domain you’ve verified.
• Attributes stay in sync. Name and status changes in your IdP are pushed to Calibre.
• Removal deactivates immediately. Removing or suspending a user in your IdP deactivates them in Calibre, removes them from the organisation, ends their sessions and revokes their personal API keys. Reactivating them later requires your IdP to send an explicit active status.

Identity provider notes#

Wording differs between providers, but the essentials are the same.

Calibre requires your IdP to be configured with:

• The ACS URL, Entity ID and certificate from Calibre, either imported from metadata or entered manually. (See Step 1 and Step 2.)
• The Name ID set to the user’s email address, with format EmailAddress.
• A Name attribute mapped to the user’s full name.

Okta#

• Find the IdP metadata URL under the application’s Sign On tab (the Identity Provider metadata link), or paste the SSO URL, Issuer and certificate manually.
• Set Application username to Email, and Name ID format to EmailAddress.
• Add an attribute statement named Name mapped to user.displayName.
• For SCIM, enable provisioning under Provisioning → Integration and paste Calibre’s SCIM Base URL and bearer token.

Microsoft Entra ID (Azure AD)#

• The App Federation Metadata URL is on the application’s Single sign-on (SAML) page. Paste it into Calibre, or enter the Login URL, Identifier and certificate manually.
• Set the Unique User Identifier (Name ID) to user.mail with format Email address.
• Add a claim named Name mapped to user.displayname.
• For SCIM, use the Provisioning tab and set the Tenant URL to Calibre’s SCIM Base URL and the Secret Token to the bearer token.

Google Workspace#

• From the Admin console → Apps → Web and mobile apps, add a custom SAML app, then copy the SSO URL, Entity ID and Certificate (Google doesn’t publish a single metadata URL, so use manual entry).
• Set Name ID to Basic Information → Primary email and Name ID format to EMAIL.
• Google doesn’t expose full name as one attribute, so mapping the Name attribute to Basic Information → First Name is sufficient for display.

OneLogin#

• The Issuer URL / metadata URL is on the application’s SSO tab. Paste it into Calibre, or enter the SAML 2.0 Endpoint, Issuer and X.509 certificate manually.
• Set the NameID to Email with format EmailAddress.
• Add a parameter named Name mapped to the member’s full name.
• For SCIM, configure the Provisioning and API Connection tabs with Calibre’s SCIM Base URL and bearer token.

Security and privacy#

SAML Single Sign-On delegates access control to your identity provider and adds several safeguards. It forms part of Calibre’s wider security and compliance practices.

• Centralised access control. Your IdP governs access, so your existing MFA, conditional access, device policies and offboarding apply to Calibre.
• Verified domains only. Calibre accepts assertions only for email addresses on domains you’ve verified by DNS.
• Session and rate limits. Calibre honours your IdP’s session expiry (SessionNotOnOrAfter) within its own bounds.
• Least-privilege defaults. New users receive only the default role and team you choose.
• First sign-in. On a user’s first SAML sign-in, Calibre sends a welcome email and creates a contact in Intercom (a listed sub-processor) for product communication and support.

Every SAML and SCIM event, including configuration changes, sign-ins and session revocations, is recorded in your organisation’s Audit log.

Have more questions?#

Please contact our friendly, technical support team.