SSO and SCIM

Your identity provider decides who gets in

Your people sign in to the organization through the provider you already run, over OIDC or SAML 2.0. Require it, and every token, SSH key and agent needs its person's say-so too. With SCIM, the provider adds people, sets their roles and removes them when they leave.

RegisterRead the docs

Your provider

OIDC or SAML 2.0, through Keycloak

Choose OIDC or SAML 2.0, and a preset for Microsoft Entra ID, Google Workspace, Okta, JumpCloud or ADFS, or any other provider. Keycloak brokers the sign-ins, so Branchscope never sees the provider's passwords. An owner tests the connection by signing in through it before it can be turned on, and the client secret is encrypted and never shown again.

acme › Single sign-on

Protocol

OIDC

  • Microsoft Entra ID
  • Google Workspace
  • Okta
  • Another OIDC provider

SAML 2.0

  • Microsoft Entra ID
  • Okta
  • Google Workspace
  • JumpCloud
  • ADFS
  • Another SAML provider

https://sso.branchscope.example/realms/branchscope/broker/org-acme/endpoint

Requiring SSO

Required for members, with time to switch over

Verify your domains with a DNS record, and sign-ins with an email on them go to your provider; no other organization can claim them. Once you require SSO, members reach the organization's repositories only after signing in through it, for the hours you set, 24 by default. Credentials get a grace period of 14 days to be authorized, which owners can end early or extend once by up to 30 days. Just-in-time membership, off by default, lets people from your domains join as members when they first sign in.

acme › Single sign-on

Verified domains

  • acme.comVerified
  • acme.exampleNot verified
  • On: sign-ins with an email on a verified domain go to it
  • Require SSO: members reach acme's repositories only after signing in through it
  • Just-in-time membership: people who sign in through it with an email on a verified domain join as members

Members' tokens, SSH keys and agents keep working while they're linked to the provider. Outside collaborators and site administrators aren't held to it.

Credentials

Every token and agent authorized by its person

Where SSO is required, each personal token, SSH key, app and agent reaches the organization only once its person has authorized it, signed in through the provider, in the web app. A token can't authorize itself, and neither can an agent. One that's refused is told exactly what its person has to do, and on which page.

alice › Access tokens
  • deploy-scriptacme · AuthorizedConfigure SSO
  • laptopacme · Not authorized: it can't reach the organization's repositoriesConfigure SSO
~/invoices
$ bscope repo view -R acme/invoices
bscope: acme requires SSO: the agent claude-code isn't authorized for acme: alice signs in with Okta, then Settings → Authorizations → Configure SSO (/settings/authorizations in the web app)

SCIM

People and groups from your provider

SCIM 2.0 lets your provider add people, change them and remove them. Deactivating someone ends their access to the organization at once: membership, sessions and authorizations. Groups you choose make owners; every other provisioned member is a member, and the last owner always stays one. Branchscope implements the users and groups endpoints with equality filters, paging and PATCH; not bulk, sorting or ETags. An organization has at most two live SCIM tokens, for rotating.

acme › Single sign-on › SCIM

SCIM base URL

https://api.branchscope.example/scim/v2/acme

42 people provisioned, 40 active, 37 bound to accounts.

Groups that make owners

  • platform-admins (3 members)
  • engineering (38 members)

Members of these groups are owners; every other provisioned member is a member. The last owner always stays one.

Two tokens at most: revoke the old one once the provider uses the new one.

On the record

Everything on the organization's audit log

The provider being set, tested or removed, domains verified, sign-ins through it, just-in-time members, credentials authorized and their authorizations ended, the grace period, and each identity and group SCIM provisions, binds, changes or removes. Never a secret, a token or a SAML or SCIM document.

acme › Audit log
  • scimprovisioned dave@acme.comscim.user_provisioned
  • davesigned in through Oktasso.signed_in
  • scimbound dave@acme.com to the account davescim.user_bound
  • aliceverified the domain acme.comsso.domain_verified
  • alicerequired SSO, with a grace period for authorizing credentialssso.grace_started

Bring your identity provider

Open your organization's Settings → SSO, connect your provider, test it, and turn it on.

Register