This page explains the concepts. To turn it on step by step, follow the SSO setup guide.
SAML SSO per tenant
Recurso’s dashboard supports SAML 2.0 single sign-on per tenant, which covers Okta, Azure AD / Entra, Google Workspace, OneLogin, JumpCloud, and any other standards-compliant IdP. This page walks the Okta recipe; other IdPs differ only in where the fields live.1. Create the Okta app
In Okta Admin: Applications → Create App Integration → SAML 2.0, then:
Recurso’s SP metadata is served at the metadata URL above — most IdPs can
import it directly instead of hand-filling the fields.
2. Configure Recurso
From the dashboard: Security → Single Sign-On, paste the IdP metadata URL (or XML) from Okta’s Sign On tab. Via API:3. Sign in
Users pick “Sign in with SSO” on the login page (or start from the Okta tile). Assertions are replay-protected and sessions ride the same httpOnly-cookie auth as password logins; MFA policy stays with your IdP.SAML SSO composes with Recurso’s own MFA and team roles: SSO decides
who gets in, roles decide what they can do, and every config change
they make lands in the audit log.