Use SAML 2.0 single sign-on (SSO) to let team members access StoryChief through your organization's identity provider (IdP). SSO is available with StoryChief Enterprise and can also be purchased as an add-on.
Before you begin: An IT administrator who can create and configure SAML applications in your IdP should complete this setup. You also need the StoryChief workspace owner and StoryChief Support.
How StoryChief SSO works
StoryChief acts as the SAML service provider (SP). A user starts from the StoryChief SSO login page or a protected StoryChief workspace URL, authenticates with your IdP, and is returned to StoryChief through the Assertion Consumer Service (ACS) URL.
StoryChief identifies the user by the SAML NameID. The value sent as NameID must be the user's email address and must match the email address of their existing StoryChief user.
Important: SAML SSO does not create users or assign StoryChief roles from SAML attributes. Add users to the workspace first by inviting them in StoryChief or by using SCIM provisioning. Roles and workspace access are managed in StoryChief or through SCIM.
1. Contact StoryChief Support
Send StoryChief Support your IdP metadata XML, or provide these values separately:
- IdP entity ID or issuer
- SSO/sign-on URL
- Single logout URL
- X.509 signing certificate
- Your StoryChief workspace name and URL
Contact support@storychief.io or use the chat in StoryChief. Support will create the SAML configuration and connect it to your workspace.
2. Configure StoryChief in your identity provider
After Support enables SSO:
1. Sign in to StoryChief as the workspace owner.
2. Open Settings → SSO.
3. Copy the service-provider values into your SAML application.
Always use the values shown in the relevant workspace. SAML URLs are specific to each StoryChief configuration.
IdP field | StoryChief value |
Sign-on method | SAML 2.0 |
Entity ID / Audience / Identifier | Entity ID shown under Service Provider |
Reply URL / ACS URL | Assertion Consumer Service shown under Service Provider |
ACS binding | HTTP-POST |
Name ID format |
|
Name ID value | User's StoryChief email address |
Signature algorithm | RSA-SHA256 |
Digest algorithm | SHA256 |
If your IdP supports metadata import, use the StoryChief Entity ID/metadata URL shown on the SSO screen.
Configure the IdP to sign the SAML response or assertion with RSA-SHA256 and a SHA256 digest. Do not encrypt the assertion or NameID, and do not require StoryChief authentication requests to be signed.
3. Add and assign users
Before a user can sign in with SSO:
- Add the user to the StoryChief workspace.
- Assign the user to the StoryChief application in your IdP.
- Make sure the IdP sends the same email address that the user has in StoryChief as `NameID`.
SAML attributes such as names, groups, or roles are not used to update the StoryChief user. Manage roles in StoryChief or through SCIM.
If your users access multiple StoryChief workspaces with different identity providers, contact Support before rollout.
Certificate and IdP changes
Contact StoryChief Support before changing your:
- X.509 signing certificate
- IdP entity ID
- Sign-on or logout URL
- Name ID format
Include the workspace name and planned activation time so Support can coordinate the change and help prevent login interruptions.
Signing out
Your identity-provider session may remain active after signing out of StoryChief. If a user is immediately signed in again, sign out from the IdP as well or test in a private/incognito window.
FAQ's
Does StoryChief support just-in-time user provisioning?
No. Add the user before their first SSO login. Use SCIM for automated provisioning and deprovisioning.
Does StoryChief map SAML groups or roles?
No. Manage roles in StoryChief or through SCIM.
Which SAML binding does StoryChief use?
The StoryChief ACS endpoint receives SAML responses through HTTP-POST.
Which Name ID format should I use?
StoryChief uses the `persistent` format by default. Regardless of the format, the `NameID` value must be the user’s StoryChief email address. Contact Support if your IdP requires another format.