SSO (Single Sign-On)

SSO lets your organization's members sign in to TaskView using your corporate identity provider (IdP). Supported protocols: SAML 2.0 and OpenID Connect (OIDC).

How it works

1. User enters their email on the TaskView login page (SSO tab)
2. TaskView looks up the email domain (e.g. company.com) and finds the matching SSO config
3. User gets redirected to your IdP (Okta, Azure AD, etc.)
4. User authenticates at the IdP
5. IdP redirects back to TaskView with identity proof
6. TaskView creates an account (if new) and logs the user in

Users who sign in via SSO are automatically added to the organization that owns the SSO config.

Setting up SSO

Go to your organization's settings → SSO tab. You need the admin or owner role.

SAML 2.0

Required fields:

Using Metadata URL (recommended):

Instead of filling fields manually, paste your IdP's metadata URL and click Sync. This auto-fills the IdP SSO URL, Certificate, and Logout URL from the metadata XML.

Example metadata URLs:

• Okta: https://your-org.okta.com/app/xxx/sso/saml/metadata
• Azure AD: https://login.microsoftonline.com/{tenant}/federationmetadata/2007-06/federationmetadata.xml
• Keycloak: http://your-keycloak/realms/{realm}/protocol/saml/descriptor

SP Entity ID is not filled from metadata - you set it yourself. It must match between TaskView and your IdP.

SAML signature requirements

TaskView requires that your IdP signs SAML Assertions. Without a valid signature, authentication will be rejected.

IdP configuration:

TaskView validates the assertion signature. The document (response) signature provides additional transport-level integrity. Both should be enabled for maximum security.

Note: If you encounter "Invalid signature" errors with both signatures enabled, verify that your IdP certificate is correct. Re-sync from metadata URL if needed.

Request signing (enterprise, optional):

For environments that require signed AuthnRequests, you can provide an SP signing key pair. Generate it with:

openssl req -x509 -newkey rsa:2048 -keyout sp-key.pem -out sp-cert.pem -days 3650 -nodes -subj "/CN=taskview"

Paste sp-key.pem contents into SP Private Key and sp-cert.pem into SP Certificate in TaskView. Upload sp-cert.pem to your IdP so it can verify the signature.

When signing keys are provided, TaskView signs AuthnRequests with RSA-SHA256.

OpenID Connect (OIDC)

Required fields:

Example issuer URLs:

• Google: https://accounts.google.com
• Azure AD: https://login.microsoftonline.com/{tenant}/v2.0
• Keycloak: http://your-keycloak/realms/{realm}

TaskView uses PKCE (S256) for the authorization code exchange. Your IdP must support the authorization code grant with PKCE.

Email domain routing

When a user enters [email protected] on the SSO login tab, TaskView checks if domain company.com has a configured SSO provider. If yes - redirect to IdP. If no - show an error.

User provisioning

When a user authenticates via SSO for the first time:

1. A TaskView account is created automatically (with a random password - they'll only use SSO)
2. A personal workspace is created for them
3. They are added to the SSO config's organization with the member role

For existing users (already registered with the same email), SSO login links their account - no new account is created, data is preserved.

Replay attack protection (SAML)

TaskView stores SAML AuthnRequest IDs in a PostgreSQL table (saml_request_cache) and validates the InResponseTo field in SAML responses. Each request ID can only be used once. This prevents replay attacks even in multi-instance deployments behind a load balancer.

Request IDs expire after 5 minutes.

API endpoints

Public

Admin (requires authentication + org admin role)

Database tables

Troubleshooting

"SSO not configured" when entering email - No SSO config exists for this email domain. Create one in organization settings.

"Invalid requester" (SAML) - SP Entity ID in TaskView doesn't match Client ID in your IdP. They must be identical.

"Invalid signature" (SAML) - IdP Certificate in TaskView is wrong or outdated. Re-sync from metadata URL or copy the certificate from your IdP's metadata XML.

"Invalid document signature" (SAML) - The document (response) signature validation failed. Verify the IdP certificate is correct and re-sync from metadata URL.

"Failed to initiate SSO login" (OIDC) - Issuer URL is wrong, or the IdP is unreachable. Verify the URL by opening {issuer}/.well-known/openid-configuration in a browser.

"Invalid parameter: redirect_uri" (OIDC) - Callback URL in TaskView doesn't match "Valid redirect URIs" in your IdP. Copy the callback URL from TaskView's SSO settings and add it to your IdP.

User logged in as wrong person - The IdP has an active session for another user. This is normal SSO behavior - the IdP controls sessions, not TaskView. Use a different browser or incognito window to test with a different user.