Volnyn – Website Builder, Domains, Property, Freelancers & Free Games
Open App

Set up single sign-on (SSO)

Let your team sign in to Volnyn through your identity provider with SAML 2.0. Configure IdP details on the team SSO page, then use the SP login URL for IdP-initiated or SP-initiated access.

Team SSO lets members authenticate with your company’s identity provider (Okta, Microsoft Entra ID, Google Workspace SAML apps, and similar) instead of only using Google login on Volnyn.

Volnyn’s enterprise SSO for teams is SAML 2.0. There is no separate OIDC enterprise IdP wizard in the main app today.

This page is about team SAML SSO. It is different from:

  • Google login for individual Volnyn accounts
  • Cross-project SSO cookies (volnyn_sso) that keep you signed in across Volnyn, Freelancer, Property, Builder, and AI site apps after a normal login

Who can manage SSO

Only the team owner can change SSO / SCIM settings on /user/sso.

Prerequisites

  • A Volnyn team you own
  • Admin access to your IdP
  • Your IdP’s:
    • Entity ID
    • SSO (sign-on) URL — must be https://
    • X.509 signing certificate (PEM or base64)
  • Optional: the email domain whose users may auto-join via SSO (for example acme.com)

How team SSO works

  1. You enable SAML and paste IdP metadata fields in Volnyn.
  2. Users open the team’s SAML login URL (or start from the IdP app tile).
  3. The IdP authenticates them and posts an assertion to Volnyn’s ACS endpoint.
  4. Volnyn establishes a session for the matching user / team membership rules tied to your connection.

SP metadata and login live under /saml/{team}/… (metadata, login, ACS).

Configure SAML in Volnyn

  1. Open SSO settings: /user/sso.
  2. Enter:
    • Email domain (optional but recommended) — e.g. acme.com
    • IdP entity ID
    • IdP SSO URL (https://…)
    • IdP X.509 certificate
  3. Enable SAML.
  4. Save.

Volnyn rejects certificates it cannot parse and SSO URLs that are not HTTPS, so bad config fails at save time instead of only at login.

Values to give your IdP

Use your environment’s public URLs. Typical SP endpoints (replace {team} with the team id):

Setting Value
ACS / Reply URL https://your-host/saml/{team}/acs
Entity ID / Audience From SP metadata: /saml/{team}/metadata
Sign-on URL (SP-initiated) /saml/{team}/login

Exact field names vary by IdP. Prefer downloading SP metadata from /saml/{team}/metadata when your IdP can import it.

Configure the IdP

High-level steps (Okta, Entra, Google, etc.):

  1. Create a SAML application for Volnyn.
  2. Paste ACS URL, entity ID / audience, and Name ID = email (typical).
  3. Assign users or groups.
  4. Copy the IdP SSO URL, entity ID, and signing certificate into Volnyn.
  5. Test with /saml/{team}/login.

After a normal Volnyn login (including Google), Volnyn can mint a signed volnyn_sso cookie so Freelancer, Property, Builder, and AI website apps recognize the same person. That cookie is not configured on /user/sso — it is platform identity wiring, not IdP SAML.

Limitations

  • SAML only for team enterprise SSO (no OIDC IdP setup UI)
  • Team-owner management only
  • Certificate and HTTPS URL validation are strict by design
  • SCIM provisioning is separate — see SCIM

FAQ

Can I use SSO without SCIM?
Yes. SAML SSO can run alone. SCIM is optional for automatic member create/deactivate.

What if login fails after saving?
Confirm the certificate is the signing cert, ACS URL matches production HTTPS, and the user’s email matches membership / domain expectations.

Does SSO replace Google login for everyone?
SSO is team-scoped. Individuals can still use Google login for personal accounts where that flow is enabled; team policy may steer employees through the IdP.