Single sign-on (SAML + SCIM)

Overview

Hjarni implements SAML 2.0 for login. Your IdP authenticates the user. Hjarni trusts the signed assertion.

SCIM 2.0 is optional for provisioning. Your IdP pushes user create, update, and deactivate calls to Hjarni. Accounts stay in sync without anyone logging in first.

SSO is configured per team. Enable it for one team and leave others on password, Google, or GitHub login. Or require SSO for everyone on a team.

Requirements

Configure your IdP

In your IdP, create a new SAML 2.0 application using the service-provider details below. Replace <team_id> with the numeric ID of your Hjarni team (visible in the address bar when you open Team settings > SSO).

If your IdP supports SP metadata import, point it at the SP metadata XML URL above instead of typing each field by hand.

Attribute statements

Hjarni reads the user's email from the SAML assertion. Any of these attribute names work out of the box:

• email: common in Okta, Auth0, OneLogin.
• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress: Microsoft Entra, ADFS, Auth0 (default mapping).
• urn:oid:0.9.2342.19200300.100.1.3: LDAP / OID style.

No extra attribute mapping is required for the major providers. Optional givenName and surname are read under the same naming styles.

Configure Hjarni

From your IdP's setup page, copy three values:

• IdP SSO URL. Where Hjarni sends users to authenticate.
• IdP Entity ID / Issuer. Identifies the signing source.
• X.509 Certificate (PEM). Verifies the signed assertion.

Where to find each, by provider:

In Hjarni, go to your team > SSO (or visit /teams/<team_id>/sso) and paste the three values. Two optional fields:

• Email domain. Enables /sso discovery: members type their work email and Hjarni routes them to your IdP. It also double-checks that the asserted email matches this domain.
• Require SSO. See Enforce SSO below. Leave off for the first test.

Save. The SP details on the right of the page now show the URLs to hand to your IdP admin if you haven't already.

Test login

1. Make sure your test user exists in your IdP and has been assigned to the Hjarni application.
2. Open an incognito window (so you start with no Hjarni session).
3. Visit https://hjarni.com/sso, enter the user's work email, click Continue.
4. Your IdP's login screen appears. Authenticate.
5. You should land on the Hjarni dashboard as that user, automatically added to the team.

If you assign a new user in the IdP after the team is set up, the next login will just-in-time provision them. No manual invite needed.

Enforce SSO

Once SSO is working for at least one team owner, you can require it for all team members. With Require SSO on:

• Password, Google, and GitHub logins are blocked for anyone on the team. They get redirected to /sso with a "your team requires SSO" message.
• Adding the user to your IdP becomes the only way to grant Hjarni access.
• Removing the user from your IdP (or sending active: false via SCIM) is the only way to revoke it.

Turn this on only after a successful SSO test as the team owner. If the IdP is misconfigured, enforcement can lock everyone out of the team. Including you.

SCIM provisioning (optional)

SCIM lets your IdP push user lifecycle changes to Hjarni without anyone needing to log in first. New hires get a seat the day they're added in Okta. Offboarded employees lose access the second they're removed.

Mint a bearer token

In Hjarni, go to your team > SCIM (or /teams/<team_id>/scim_tokens) and click Generate token. The token is shown once. Copy it immediately.

Hand it to your IdP

What's supported

• Users: full lifecycle. POST creates, PATCH updates, active: false or DELETE removes the team membership. The underlying account survives in case the user is in other teams.
• Filters: userName eq, externalId eq, emails eq.
• Groups: returned as an empty list. We don't sync groups to team roles in v1. Promote owners manually in the Hjarni UI.

Test it without an IdP

curl -X POST https://hjarni.com/scim/v2/Users \
  -H "Authorization: Bearer YOUR_SCIM_TOKEN" \
  -H "Content-Type: application/scim+json" \
  -d '{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
    "userName": "alice@bigco.com",
    "externalId": "okta-12345",
    "active": true
  }'

Troubleshooting

Related docs