CamperDocs
Open app

Directory

Enterprise SSO

Camper’s dashboard can authenticate operators through your corporate IdP. This is sign-in, not directory provisioning.

ConcernMechanism
Who exists / org chart / rolesSCIM
How they open the dashboardSSO (this page), email OTP, password, passkeys, Google

OIDC vs SAML

Camper supports both OpenID Connect and SAML 2.0.

OIDC (recommended)SAML 2.0
Best forNew Okta / Entra / Google appsWhen IT policy or IdP app type requires SAML
SetupIssuer + client ID/secret + redirect URIMetadata XML or SSO URL + signing cert
Day-2Simple secret rotationCert / metadata lifecycle

Recommendation: use OIDC unless your security team or IdP only offers SAML. Neither protocol replaces SCIM for directory and roles.

Supported protocols

  • OIDC — Okta, Entra ID, Google Workspace, Auth0, …
  • SAML 2.0 — same IdPs via metadata XML or SSO URL + cert

Configure (tenant admin)

  1. Open Settings → Identity Providers.
  2. Add provider — prefer the OIDC templates (Okta, Entra, Google); use SAML 2.0 only when required.
  3. The guided form asks for what your IdP gives you (e.g. Okta domain + client credentials). Copy the shown redirect URI / ACS URL into your IdP app. Claim the email domain (e.g. acme.com).
  4. Publish the DNS TXT verification token, then Verify:
    • Host (name): _{prefix}-{provider-id} as a subdomain of the claimed domain
    • Value: the token string Camper shows (bare token is enough)
  5. Until the domain is verified, sign-in through that IdP is blocked.

The prefix is environment-specific so prod and dev can claim the same email domain without fighting over one TXT record:

EnvironmentDNS host example (getcamper.io + getcamper-io-okta)
Production (app.getcamper.io)_better-auth-token-getcamper-io-okta.getcamper.io
Dev / local_better-auth-token-dev-getcamper-io-okta.getcamper.io

Always copy the host Camper shows in the prompt — do not invent the name.

The TXT is not on the apex alone. Override the prefix with
CAMPER_SSO_DOMAIN_TOKEN_PREFIX only if you need a custom segment.

Callback URLs are under the Camper auth base (/api/auth/sso/…). OIDC redirect URI is returned on register; SAML ACS is /api/auth/sso/saml2/sp/acs/{providerId}.

OIDC discovery hosts

Camper allowlists common public IdP discovery hosts (Okta, Okta Preview, Entra, Google) so registration can fetch /.well-known/openid-configuration. If you use a private or custom OIDC issuer and registration fails with Untrusted OIDC discovery URL, ask your Camper operator to add that issuer’s origin to CAMPER_TRUSTED_ORIGINS (comma-separated, e.g. https://idp.corp.example).

Enforce SSO

After at least one domain is verified:

  1. Turn on Require SSO for claimed domains.
  2. OTP, password, passkeys, and Google social are blocked for emails on those domains.
  3. Users must Continue with SSO (Camper routes by domain).

Break-glass accounts

When enforcement is on, pick break-glass members (tenant operators) who may still use email code / password if the IdP is unavailable. Prefer a small set of owner/admin accounts. Break-glass is per platform user (email), not a shared password vault.

Enforcement is enforced server-side, not only in the login UI.

Sign-in flow

  1. On the login page, enter a work email on a claimed domain.
  2. Choose Continue with SSO (or submit email when SSO is enforced — Camper starts SSO automatically).
  3. Camper matches the email domain to the verified provider and redirects to the IdP.
  4. After assertion / token exchange, you land on the dashboard with a normal Camper session.

OTP, password, passkeys, and Google remain available for domains without enforcement, and for break-glass users when enforcement is on.

JIT vs SCIM

First-time SSO can create a platform user and attach them as a member of the tenant linked to the provider. Prefer SCIM provisioning so people and roles exist before first login — JIT is the fallback.

Universal Logout (Okta)

If you use Okta, registering the OIDC client also enables Universal Logout: Okta can POST to Camper’s Global Token Revocation endpoint and clear that user’s dashboard sessions without deprovisioning them. See Okta setup → Universal Logout.

Related