Docs
Open app

SAML SSO

Configure SAML 2.0 single sign-on for your organization.

4 min readUpdated 2026-08-07

SAML SSO lets your team sign in to Doow using your organization's identity provider. Members authenticate through your IdP instead of managing separate Doow passwords.

SAML SSO settings page overview

What you need

  • A Doow workspace on the Business, Professional, or Enterprise plan.
  • An identity provider that supports SAML 2.0 (Okta, Azure AD, OneLogin, Google Workspace, or any SAML-compatible IdP).
  • Admin access to both Doow and your identity provider.

How it works

  1. A member visits Doow and enters their email address.
  2. Doow redirects the member to your identity provider.
  3. The member authenticates with your IdP (password, MFA, etc.).
  4. Your IdP sends a signed SAML assertion back to Doow.
  5. Doow verifies the assertion and signs the member in.

Step 1: Configure your identity provider

Before configuring Doow, create a SAML application in your identity provider. You need two values from Doow to complete the IdP setup:

  1. Go to Company Settings → SAML SSO in your Doow workspace.
  2. Copy the ACS URL (Assertion Consumer Service URL).
  3. Copy the Entity ID (Service Provider Entity ID).

Copy ACS URL and Entity ID from Doow

Use these values when creating the SAML application in your IdP.

Attribute mappings

Configure your IdP to send these attributes in the SAML assertion:

Doow attributeIdP attributeRequired
firstNameFirst nameYes
lastNameLast nameYes
emailEmail addressYes

The email attribute must match the member's email address in Doow.

Attribute mapping table showing required SAML attributes

Provider-specific guides

Select your identity provider for detailed setup instructions:

Step 2: Enter IdP credentials

Once you have the IdP values from your identity provider, return to the Doow SAML settings page and enter:

  1. IdP SSO URL — the login URL or SAML endpoint from your IdP.
  2. IdP Entity ID — the issuer URL or identifier from your IdP.
  3. IdP Certificate — the X.509 signing certificate from your IdP.
  4. Select Save.

Enter IdP metadata - SSO URL, Entity ID, and certificate

Once saved, your IdP metadata appears in the settings:

IdP metadata configured and saved

Step 3: Test the connection

Before enabling SAML SSO for your organization, test the connection:

  1. Select Test connection on the SAML SSO settings page.
  2. A new window opens and redirects you to your IdP.
  3. Sign in with your IdP credentials.
  4. If successful, Doow displays the attributes received from your IdP.

Verify that the firstName, lastName, and email attributes appear correctly. If attributes are missing or incorrect, update the attribute mappings in your IdP and test again.

Connection verified with attributes received from IdP

Enable SAML SSO

After a successful test, enable the connection:

  1. Toggle Enable SAML SSO to on.
  2. Members can now sign in using your identity provider.

Settings section with disable and enforce options

Members with email addresses that match your configured domains will be redirected to your IdP when signing in.

Require SAML SSO

To enforce SAML SSO for all members:

  1. Ensure you have successfully tested the SAML connection.
  2. Toggle Require SAML SSO for members to on.
  3. Confirm the action.

When SAML SSO is required:

  • Members must authenticate through your IdP to access Doow.
  • Password-based sign-in is disabled for members.
  • Administrators retain fallback access if your IdP is unavailable.

SAML SSO enabled and enforcement available

Signing in with SAML SSO

Once SAML SSO is enabled, members sign in through your identity provider:

  1. Go to the Doow sign-in page and click Log in with SAML SSO.

Doow sign-in page

  1. Enter your work email address and click Login.

SAML SSO login page

  1. You are redirected to your identity provider. Authenticate with your IdP credentials.
  2. After successful authentication, you are signed in to Doow.

Troubleshooting

SymptomLikely causeNext action
SAML assertion is rejectedCertificate mismatch or expiredRe-download the IdP certificate and update it in Doow
Attributes are missingIdP attribute mappings not configuredAdd firstName, lastName, and email attribute statements in your IdP
Email does not matchIdP sends a different email formatEnsure the email attribute matches the member's Doow email exactly
Redirect loopACS URL or Entity ID mismatchVerify the ACS URL and Entity ID in your IdP match the values from Doow
Members cannot sign inSAML connection is disabledEnable the SAML connection in Doow settings

Certificate issues

SAML certificates typically expire after one to three years. When your IdP certificate is rotated:

  1. Download the new certificate from your IdP.
  2. Update the certificate in Company Settings → SAML SSO.
  3. Test the connection before the old certificate expires.

Disabling SAML SSO

To disable SAML SSO:

  1. Go to Company Settings → SAML SSO.
  2. If SAML SSO is required, toggle Require SAML SSO for members to off first.
  3. Toggle Enable SAML SSO to off.

Members will return to password-based authentication. Members who do not have a password set will need to use the password reset flow.

Next steps

Was this page helpful?