Appearance
Set up SAML single sign-on
Connect your Revis organization to your identity provider (IdP), such as Okta, Microsoft Entra ID or OneLogin, so people can sign in to your organization through it. You copy revis.io's service provider details into your IdP, then give revis.io your IdP's metadata URL or its details. To make SSO the only way into the organization, turn on Require SAML SSO afterward.
Before you start
- Who: organization Owners and Admins. Other roles see "Managing SSO / SAML requires organization admin rights."
- Where: the web app.
- You need: an SSO ID for your organization (the settings call it a subdomain). Revis support sets it up for you; there's no setting for it in the app. You also need admin access to your IdP.
Open the SSO / SAML page
- Select your organization's name at the top of the sidebar.
- Select the gear next to it (Organization settings).
- Select SSO / SAML.
If the page says "Your organization needs a subdomain before SAML can be set up", contact Revis support to have an SSO ID added. Until then, the page shows no service provider details and you can't save a configuration.
Add revis.io to your identity provider
Service Provider Details lists what your IdP needs. Use the copy button next to each value.
| Label | Where it goes in your IdP |
|---|---|
| Metadata URL | Service provider metadata, if your IdP can import it |
| ACS URL | Assertion consumer service URL (also called reply URL or single sign-on URL) |
| SP Entity ID | Audience or service provider entity ID |
In your IdP, set up the app so that it:
- Signs its assertions. revis.io refuses unsigned assertions and SHA-1 signatures.
- Sends the person's email address in an attribute named
email. - Is assigned to the people who'll use revis.io, including you.
Connect your identity provider
Under Configure SAML SSO, choose one method:
- Metadata URL (recommended): paste your IdP's metadata address into IdP Metadata URL and select Import. The address must start with
https://and be reachable from the internet. - Manual Entry: enter your IdP's Entity ID, SSO URL and X.509 Certificate, plus its Single Logout URL (optional) if it has one. Change the names under Attribute Mapping only if your IdP uses different attribute names for Email, First Name and Last Name. Then select Save Configuration.
revis.io shows "SAML configuration saved". If it shows "Failed to save SAML configuration", the message under it says what's wrong, for example "The IdP certificate can't be read." Saving on its own doesn't change how anyone signs in.
Check the connection
The page now shows Identity Provider with a Configured badge, your IdP's Entity ID and SSO URL, the Certificate Expiry date and the SSO ID people sign in with.
Select Test Connection. "Connection successful" means revis.io can reach your IdP and its certificate is readable and hasn't expired. For an imported metadata URL, the test checks the certificate currently published by your IdP, which may differ from the one saved in Revis. After a certificate rotation, import the metadata again before testing a sign-in. The test doesn't sign anyone in, so also try it yourself in a private browser window: on the Revis sign-in page, select Sign in with SSO and enter the SSO ID.
How people sign in
- On the Revis sign-in page, people select Sign in with SSO, enter your organization's SSO ID and select Continue. Their IdP signs them in and sends them back to revis.io. Tell your team the SSO ID.
- Starting from the app tile in your IdP's portal isn't supported. revis.io then says "Single sign-on didn't complete" and asks them to start from the sign-in page.
- A first SSO sign-in with an email address that has no Revis account creates one and adds it to your organization as a Member. An existing Revis account can sign in with SSO only if it's already a member of your organization.
Require SSO for your organization
- In Organization settings, select Security.
- Turn on Require SAML SSO and select Save Changes.
Members get 7 days to switch. Until then they can sign in as before, and a banner tells them the date SSO will be required from. After that, members who signed in another way must sign in with SSO to open the organization, admins included. People who only belong to some of its projects (outside collaborators) aren't affected. revis.io doesn't email members about the change, so tell them first.
If SSO stops working while it's required, an Owner or Admin can sign in another way on the web and select Fix SSO settings in the SSO Required dialog. The recovery page lets you fix the configuration or select Turn off Require SAML SSO; the rest of the organization stays locked until you sign in with SSO or turn the requirement off. The desktop app has no recovery: use the web app.
Change or remove the configuration
- Change it: select Edit Configuration. Import the metadata URL again, or for manual entry paste the certificate again (revis.io doesn't show the saved one), then save. Sign-in keeps using the current configuration until you save, and Require SAML SSO can stay on.
- Remove it: turn off Require SAML SSO first, then select Remove Configuration and confirm with Remove. After removal, nobody can sign in with SSO until you connect your IdP again.
TIP
When your IdP rotates its signing certificate, update revis.io with Edit Configuration the same day. revis.io keeps one certificate, doesn't re-read your metadata URL on its own, and doesn't email anyone when the certificate expires. An expired certificate keeps working, and the page marks it "Expired".