Identity
Team SSO
Team SSO lets your colleagues sign in to Testlie itself with your company's identity provider (Okta, Microsoft Entra ID, Google Workspace, or any OIDC or SAML 2.0 IdP). It is not the same as mock identity providers, which are fake IdPs for testing your app. Team SSO is included in the Business and Enterprise plans.
How it works
Team owners and admins add providers on the Team sign-in (SSO) page. Each provider has:
- an ID (lowercase letters, digits and hyphens), which appears in its callback URL,
- one or more email domains,
- the IdP's issuer and credentials.
On the sign-in page, people choose Sign in with SSO and enter their work email. If its domain matches a provider, they are sent to that IdP, and on their first sign-in they join your team as members automatically.
OIDC
Register a web application in your IdP with this redirect URI:
https://testlie.com/api/auth/sso/callback/<providerId>| IdP | Issuer | Notes |
|---|---|---|
| Okta | https://<your-org>.okta.com, or your custom authorization server URL |
Applications, Create App Integration, OIDC, Web Application |
| Microsoft Entra ID | https://login.microsoftonline.com/<tenant-id>/v2.0 |
App registrations, platform Web, add a client secret |
| Google Workspace | https://accounts.google.com |
Google Cloud OAuth client (Web application); set the consent screen to Internal to limit it to your Workspace |
Then enter the client ID and secret. The discovery URL defaults to <issuer>/.well-known/openid-configuration.
SAML 2.0
Create a SAML application in your IdP with:
| Setting | Value |
|---|---|
| ACS (Assertion Consumer Service) URL | https://testlie.com/api/auth/sso/saml2/callback/<providerId> |
| SP entity ID / metadata | https://testlie.com/api/auth/sso/saml2/sp/metadata?providerId=<providerId> |
| Name ID | Email address |
Then enter the IdP's entity ID as the issuer, plus its SSO URL and signing certificate, or paste the IdP metadata XML.
Trying it out with a mock IdP
You can rehearse the setup without touching your real IdP: create a mock identity provider, add a test user on your domain, and register it as an OIDC provider with the mock IdP's issuer, client ID and secret, and the redirect URI above.
Other sign-in options
- Social sign-in with the providers offered on the sign-in page (currently Microsoft). Accounts with the same email address are linked across providers that prove the address.
- Two-factor authentication (authenticator app codes and backup codes) under Account.