Single Sign-On (SSO) lets your team sign in to Dosu through your own identity provider, so access follows the accounts and policies you already manage. This page covers what Dosu supports, which plan it requires, and how an admin can set it up.
What it is#
Dosu supports SSO over SAML 2.0. You can connect any SAML 2.0 identity provider, including Okta, Microsoft Entra ID, Google Workspace, OneLogin, PingIdentity, and JumpCloud. SSO ties Dosu sign-in to your provider, so the people who can reach your organization are the people your provider says can.
SSO is available on the Enterprise plan. For plan details and upgrade instructions, see the pricing page or contact Dosu.
Why it matters#
For a growing engineering organization, the login page is part of governance. SSO gives you:
- One place to grant and revoke access. When someone leaves, removing them in your identity provider removes their path into Dosu.
- Your provider's policies, applied to Dosu. Multi-factor, conditional access, and session rules you already enforce carry over.
- Less account sprawl. People sign in the same way they do for everything else, instead of managing another standalone login.
How to configure#
SSO setup is a guided process you complete with the Dosu team. It is not self-serve in the app today. To start, email customer-success@dosu.dev.
- Send Dosu your SAML metadata (a public metadata URL is preferred, or a metadata XML file) and the list of email domains that should authenticate through SSO.
- Dosu configures SSO for your organization and sends back the values to enter in your identity provider, including the ACS (Assertion Consumer Service) URL, the Entity ID, and the NameID format (set to emailAddress).
- You enter those values in your identity provider and complete the creation of the Dosu application there.
- Dosu verifies the connection and confirms setup is complete.
- People with the configured email domains can now sign in through SSO.
You do not configure SSO from a Settings page. Day-to-day access is still managed in Settings, Organization, Members.
How sign-in works#
Once SSO is set up, the Dosu login page offers a Sign in with SSO option. A user enters their work email, and the email domain routes the request to your identity provider. After they authenticate there, they return to Dosu and are signed in.
Existing users keep their accounts and data. After SSO is enabled, the next time they sign in they are prompted to authenticate through your provider, and their history stays intact.
People who are not part of your organization can still sign in to Dosu with other methods (GitHub, Google, or email). SSO governs your organization's users, not everyone on the platform.
Domain-based autojoin (optional)#
Enterprise organizations can also turn on domain-based autojoin to speed up onboarding. Autojoin is separate from SSO. You can run either one alone, both together, or neither.
When autojoin is on, anyone who signs up using an email domain you have configured is automatically added to your organization as a Member (or to the role from a pending invitation), with onboarding marked as complete. That removes the manual invite step for people on your domains. Autojoin works with any sign-in method, and it can reuse the same domains you set up for SSO.
Roles and permissions#
- Configuring SSO is an organization-level action handled with the Dosu team, so reach out from an account that administers your Dosu organization.
- SSO controls authentication (who can sign in). It does not by itself set what each person can do inside Dosu. Permissions are governed by roles. See Roles and access control and User management.
Notes and limits#
- Each organization has one SSO configuration. If you need more than one identity provider, contact customer-success@dosu.dev, and we can assist.
- Dosu supports SAML 2.0 for enterprise SSO. If your provider connects over a different protocol, ask Dosu before assuming it will work.
- Autojoin and SSO are independent features. Enabling one does not enable the other.
