Skip to main content
Single sign-on (SSO) lets your team sign in to Ravenna through the identity provider (IdP) they already use. Set it up with the guided wizard: configure your IdP, optionally verify your email domain, enable the connection, then roll SSO out to your team. Each organization has one SSO connection, which can cover more than one email domain. The wizard works the same way for every supported provider. Screenshots in this guide use Okta as an example.

​
Prerequisites

  • Organization admin access in Ravenna
  • Admin access to your IdP
  • Optional: a connected integration that syncs user profiles into Ravenna, such as an identity provider or HRIS. With one connected, you can skip the wizard’s claims mapping step.

​
Start the setup wizard

1

Open SSO settings

Go to Settings > SSO and click Connect. The setup wizard opens in a new tab.
The SSO settings page in Ravenna with the Connect button next to Connect Identity Provider
2

Get started

Open your IdP’s admin console in another tab, because you switch between the two. Then click Get Started in the bottom right of the wizard.
The Set up Ravenna page of the wizard with the Get Started button in the bottom right
3

Select Single Sign-On

On Configure Your Connection, select Single Sign-On.
The Configure Your Connection page listing Single Sign-On and Domain Configuration, with Enable Connection disabled
4

Select your identity provider

Select Okta, ADFS, Entra ID, Google Workspace, Keycloak, or PingFederate. For any other provider, select Custom SAML or Custom OIDC.
The Select Your Identity Provider page showing Okta, ADFS, Entra ID, Google Workspace, Keycloak, PingFederate, Custom SAML, and Custom OIDC

​
Configure your identity provider

The wizard shows the setup steps for the provider you selected, so step names and order vary. Complete each step in your IdP’s admin console, then click Next in the wizard.
1

Create the application and enter its connection details

Follow the wizard’s instructions to create a Ravenna application in your IdP. Then copy the connection details from your IdP into the wizard.
2

Map claims, or skip if an integration syncs your users

Claims pass user attributes, such as first and last name, from your IdP to Ravenna when users sign in.
Tip: skip this step if an integration already syncs your users. If you’ve connected an integration that syncs user profiles, click Next without adding claims, even if the wizard marks them as required. The integration already imports names, managers, departments, and groups. This includes identity providers such as Okta, Microsoft Entra ID, Google Workspace, and JumpCloud, and HRIS integrations such as BambooHR, Rippling, and HiBob.
If no connected integration syncs your users, add the claims the wizard lists to the Ravenna application in your IdP, then click Next.
Okta example: the Claims Mapping step listing given_name, family_name, and groups as required claims and manager and department as optional
3

Assign access to users and groups

In your IdP, assign the Ravenna application to the users and groups who sign in with SSO. For example, in Okta, open the application’s Assignments tab, select Assign > Assign to Groups, click Assign next to each group, then click Done.
Users who aren’t assigned to the application can’t sign in. Assign yourself before you test the connection.
Okta example: the Assign Access step showing the Assignments tab and the Assign to Groups dialog
4

Test the connection

Click Test Connection. A new window opens and signs you in through your IdP, the same way your users sign in. Keep the wizard open while the test runs. If the test fails, the wizard lists the errors.When the test succeeds, click Done.
The Test SSO step with the Test Connection button

​
Verify your domain Optional

On Configure Your Connection, you can also select Domain Configuration to add and verify the email domains your users sign in with. To skip this, go to Enable the connection.
1

Add your domain

Select Domain Configuration, enter your email domain, and click Add Domain.
The Domain Verification page with a domain field and the Add Domain button
2

Add the TXT record and verify

Under Pending Domains, select your domain to see its TXT Record Name and TXT Record Content. Add a TXT record with those values in your domain’s DNS settings, then click Verify. DNS changes can take up to 48 hours.
A pending domain showing the TXT Record Name and TXT Record Content fields with Verify and Delete buttons

​
Enable the connection

Enabling the connection usually makes SSO the only way anyone in your organization can sign in, whatever their email domain. Before you enable it, make sure you and everyone who needs Ravenna are assigned to the application in your IdP. If you’re locked out, contact Ravenna support.
1

Click Enable Connection

On Configure Your Connection, click Enable Connection in the top right. The button becomes available once Single Sign-On is complete.
The Configure Your Connection page with Single Sign-On and Domain Configuration complete and Enable Connection available
2

Confirm and proceed

The wizard asks you to confirm that you’ve assigned access to users. Click Proceed.
The Proceed to enable the connection dialog asking you to make sure access has been assigned to users
3

Close the confirmation page

The wizard confirms that the connection is enabled. Close the tab.
The confirmation page reading The connection has been enabled
4

Confirm the connection in Ravenna

Go back to Settings > SSO. Your IdP shows as Connected, with your organization’s SSO Login URL below it.Enforce SSO-Only Authentication shows Enforced if no other sign-in methods are turned on, which is the default. See Enforce SSO-only sign-in.
Okta example: the SSO settings page showing Okta SSO as Connected, the SSO login URL, and Enforce SSO-Only Authentication marked Enforced

​
Roll out SSO to your team

Users now sign in by entering their work email on the Ravenna login page and clicking Continue. Ravenna recognizes your organization’s email domain and sends them to your IdP. To give them one-click access, add the direct SSO login URL to your IdP’s app portal.

​
Direct SSO login URL

The direct SSO login URL skips the email step and opens your IdP directly. Copy it from SSO Login URL on Settings > SSO. It looks like this:

​
Add the URL to your IdP portal

Set the URL as the login or home page URL of the Ravenna application in your IdP.
Go to Applications > your app > General and paste the URL into Login URL.

​
Next steps

User management

Give SSO users roles and workspace access.

Manage SSO

Edit, disconnect, or delete your connection.

Troubleshooting

Fix a failed test or sign-in errors.
Last modified on October 2, 2026