SSO and provisioning

ProFinda supports SAML 2.0 and OpenID Connect for sign-in, and SCIM 2.0 for automated account provisioning. Most firms use Entra ID or Okta; both work with either protocol.

Set up SSO first, SCIM second

Provisioning creates accounts; SSO lets people into them. Configure and test SSO with a handful of manually created accounts before enabling SCIM, so a provisioning misconfiguration cannot lock out the whole firm.

SSO setup outline

1. In Admin → Security → Single sign-on, choose SAML or OIDC and copy the service provider details (entity ID and ACS URL, or redirect URI).
2. Create the app in your identity provider using those values.
3. Map attributes: email is the join key and must match the address held in ProFinda. Send given name, family name and employee ID as a minimum.
4. Upload the IdP metadata (or issuer and client credentials for OIDC) back into ProFinda and use Test sign-in with your own account.
5. Enable Enforce SSO only after a successful test. This disables password sign-in for everyone except break-glass admin accounts.

SCIM provisioning

SCIM creates, updates and deactivates accounts from your IdP groups. Generate a SCIM token under Admin → Security → Provisioning, configure the IdP with the SCIM base URL and token, and scope provisioning to a group rather than the whole directory. Group membership can also drive role assignment.

Note that SCIM handles accounts, not people data. Grade, location and org structure come from the Workday integration; if you run both, email address must be consistent across all three systems.

Common failure

The most frequent ticket is a sign-in loop caused by an email mismatch between the IdP assertion and the ProFinda account. Compare the two values in the SSO test tool before raising anything with support.