Skip to main content
Single sign-on (SSO) lets users sign in through your identity provider (IdP) instead of a separate Planasonix password. Planasonix supports SAML 2.0 for enterprise IdPs, plus OIDC-based providers (Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin, and generic OIDC) where configured.
SSO is available on the Enterprise plan. Organization admins configure providers under Settings → SSO.

​
How sign-in works (SP-initiated)

Planasonix uses service provider (SP)–initiated SAML for launch:
  1. The user starts at the Planasonix sign-in page and chooses SSO for your organization.
  2. Planasonix redirects the browser to your IdP with a SAML authentication request.
  3. After the user authenticates at the IdP, the IdP posts the assertion back to Planasonix’s Assertion Consumer Service (ACS).
  4. Planasonix validates the response and establishes the session.
Users always begin in Planasonix for this flow. Launching Planasonix from an IdP app tile (IdP-initiated SSO) is not supported at launch; support is planned for a later release.

​
Values your IdP needs

Open Settings → SSO, add or edit your SAML provider, and copy: Copy these values exactly (including scheme and path). Trailing-slash mismatches are a common cause of login failures. You can also download SP metadata from Planasonix when your IdP accepts a metadata URL or XML upload.

​
Configure SAML

1

Create the SAML app in your IdP

Register Planasonix as a service provider. Paste the ACS URL and Entity ID from Planasonix. Prefer signed assertions; Planasonix validates audience, issuer, signatures, and replay protections on the ACS response.
2

Exchange IdP metadata

In Planasonix, upload IdP metadata XML, or paste SSO URL, signing certificate, and related fields. Assign users or groups in the IdP so they can complete SSO.
3

Map attributes

Map email (and optional name / group claims) so Planasonix can identify users. Email-format Name ID is the usual choice.
4

Test from Planasonix

Use Verify on the provider (when available), then sign in from an private/incognito window starting at the Planasonix login page. Confirm the user lands in the correct organization.

​
Identity provider guides

Okta

SAML 2.0 app integration.

Microsoft Entra ID

Enterprise application + SAML.

Google Workspace

Custom SAML app.

Auth0

SAML or OIDC applications.

OneLogin

SAML application setup.

Generic OIDC

Issuer, client ID, and discovery.

​
Certificate rotation

Plan certificate rotation before IdP signing certificates expire. Upload the new certificate (or refreshed metadata), test with a pilot user from the Planasonix login page, then retire the old certificate. Failed rotation surfaces as login errors for all SSO users.
Just-in-time (JIT) provisioning can create users on first successful SSO login when enabled on the provider. Otherwise, pre-provision accounts in Planasonix before cutover.

Session policy

Timeouts and related session controls after SSO.

MFA

MFA when you are not using IdP-managed factors.

Plans and pricing

Enterprise tier features.

Teams and permissions

Roles after users are provisioned.