Directory
Enterprise SSO
Camper’s dashboard can authenticate people through your corporate IdP. This is sign-in, not directory provisioning.
| Concern | Mechanism |
|---|---|
| Who exists / org chart / roles | SCIM |
| How they open the dashboard | SSO (this page), email code, password, passkeys, Google |
OIDC vs SAML
| OIDC (recommended) | SAML 2.0 | |
|---|---|---|
| Best for | New Okta / Entra / Google apps | When IT policy requires SAML |
| Setup | Issuer + client ID/secret + redirect URI | Metadata XML or SSO URL + signing cert |
| Day-2 | Simple secret rotation | Cert / metadata lifecycle |
Use OIDC unless your security team or IdP only offers SAML. Neither protocol replaces SCIM for directory and roles.
Prerequisites
- Owner or admin in Camper
- Ability to create an OIDC or SAML app in your IdP
- Ability to create a DNS TXT record on the email domain you claim
Summary of steps
- Add provider in Camper and complete the IdP-side app
- Verify domain with the DNS TXT record Camper shows
- Optionally require SSO for claimed domains (after picking break-glass accounts)
Configure
Setup runs as a three-step wizard — Choose IdP → Configure → Verify domain. You can leave at any point; work already saved stays on the provider row.
- Open Settings → Identity Providers → Add provider.
- Choose IdP — prefer OIDC (Okta, Entra, Google); use SAML 2.0 only when required.
- Configure — complete the guided form:
- Okta — OIN / OIDC app; you mainly need your tenant slug (shown on the form), Okta base URL, client ID/secret, and email domain.
- Custom OIDC / Entra / Google / SAML — redirect URI (or SAML ACS) and related URLs appear inside the form with copy buttons. Callback paths use your tenant slug.
- Verify domain — claim the email domain (e.g.
acme.com), publish the DNS TXT record, then Verify domain.
Until the domain is verified, sign-in through that IdP is blocked.
Re-opening the DNS record
The token is not lost when you close the dialog. Use DNS record on the provider row to reopen the same host and token. If verification says the token expired, Request a fresh token, update DNS, and verify again.
When verification fails
| Camper found | What to do |
|---|---|
| No TXT at that name | Publish the record, wait for DNS, retry |
| TXT value is not Camper’s token | Re-copy the full token (no quotes), replace the record |
| Token expired | Fresh token + update DNS |
| DNS lookup failed | Check the host name, retry shortly |
Always copy the host and token Camper shows — production and non-production environments use different host prefixes so the same company domain can be claimed in both.
Removing a provider
Removal asks for confirmation. People on that domain fall back to email code, password, passkeys, or Google. Nobody is removed from the workspace. Reconnecting means publishing a new TXT record.
Configuration Steps in Okta
OIDC SSO and SCIM are separate. This section is sign-in only. Directory push is Okta setup.
In Camper
- Open Settings → Identity Providers → Add provider.
- Choose Okta.
- Copy the tenant slug shown on the form. It is the path segment in the sign-in redirect URI.
- After you have the Okta app credentials, enter:
- Email domain — people at this domain sign in with Okta
- Okta Base URL — org host only (for example
acme.okta.com), not*-admin.okta.com - Client ID and Client secret from the Okta app
- Complete Verify domain (DNS TXT). Sign-in through this IdP stays blocked until the domain is verified.
In Okta
Prefer the Camper app under Applications → Browse App Catalog once it is in the Okta Integration Network. That app is pre-wired for Camper; you mainly supply the tenant slug.
If you are registering a custom OpenID Connect app (for example while the catalog app is not available), configure these values from Camper — do not invent a second callback path:
| Setting | Value |
|---|---|
| Sign-in redirect URI | https://app.getcamper.io/api/auth/sso/callback/{tenant-slug} |
| Initiate login URI | https://app.getcamper.io/login |
| Grant type | Authorization Code (PKCE) |
| Scopes | openid, email, profile |
Do not add a Refresh Token / offline_access grant. Camper requests openid email profile only.
Assign the people who should open the Camper dashboard. Copy the app’s Client ID and Client secret into the Camper form. Do not put the SCIM bearer token in the OIDC client secret field.
Do not configure OIDC Single Logout, end_session, or a Post-logout redirect URI for Camper. See Single Logout.
Optional: set Okta Universal Logout to Camper’s Global Token Revocation endpoint — Okta setup → Universal Logout.
Sign-in modes
| Mode | How it starts |
|---|---|
| SP-initiated | User opens Camper → work email → Continue → Camper starts SSO → IdP → back to Camper |
| IdP-initiated | User opens the Camper app in the IdP → lands on Camper and completes the same OIDC flow |
Enforce SSO
After at least one domain is verified:
- Pick break-glass accounts first — the picker is available before enforcement is on.
- Turn on Require SSO for claimed domains. Camper lists break-glass accounts that will still work.
- OTP, password, passkeys, and Google social are blocked for emails on those domains (except break-glass).
If you enable enforcement with zero break-glass accounts, Camper warns you: should the IdP go down, nobody — including you — can sign in. You can still proceed, but pick a fallback first unless you have a reason not to.
Break-glass is per platform user (email), not a shared password vault. Enforcement is enforced server-side, not only in the login UI.
JIT vs SCIM
First-time SSO can create a platform user and attach them as a member of the tenant. Prefer SCIM so people and roles exist before first login — JIT is the fallback.
Single Logout
Camper does not support OIDC Single Logout (SLO) / RP-initiated logout via a standard end_session flow with Okta as OP. Session end on the Camper side is handled by application sign-out (Camper session cookie). For Okta-driven session revocation we support Universal Logout via Global Token Revocation (not OIDC SLO).
Universal Logout (Okta)
If you use Okta OIDC, you can enable Universal Logout so Okta can clear Camper sessions without deprovisioning. See Okta setup → Universal Logout.
Private / custom OIDC issuers
Common public discovery hosts (Okta, Entra, Google) work out of the box. If registration fails with Untrusted OIDC discovery URL for a private issuer, contact Camper support — the platform allowlist may need your issuer origin added.