SAML 2.0 single sign-on is available for Business workspaces.
Service provider settings
In your workspace settings under SSO SAML, lien.to provides your ACS (Assertion Consumer Service) URL and Entity ID. Enter these values into your identity provider (IdP), set the email attribute to email (or provide a NameID in email format), and require signed assertions (in Keycloak, enable « Sign assertions »). Existing accounts using your domain are linked to your workspace upon their first SSO login.
DNS domain verification
To prove ownership of your team’s email domain, add it to the claimed domains list. Lien.to provides a DNS TXT record with a verification token. Add this record to your DNS host. Lien.to automatically checks the record at regular intervals for the duration indicated in your settings, and you can trigger a manual check from your settings.
Testing and enforcement
Before enforcing SSO, click « Test connection ». This simulates the SAML exchange without creating a user session. Once the domain is verified and the test succeeds, you can enable mandatory SSO: domain members must authenticate through your provider, and any password sessions are closed. The workspace owner always retains a break-glass login with password and two-factor authentication (2FA).
Okta
Create a new SAML 2.0 application integration in your Okta admin console. Enter the ACS URL into _Single Sign-On URL_ and the Entity ID into _Audience URI (SP Entity ID)_. In Attribute Statements, add an attribute named email with value user.email. Download the X.509 certificate or copy the metadata URL to complete configuration in lien.to.
Entra ID
In Microsoft Entra ID, add an enterprise application configured for SAML single sign-on. Set the Entity ID in _Identifier (Entity ID)_ and the ACS URL in _Reply URL (Assertion Consumer Service URL)_. In Attributes & Claims, ensure the email claim is mapped with the name email. Copy the App Federation Metadata URL or download the Base64 certificate.
Google Workspace
In Google Workspace Admin, navigate to Apps, SAML apps, and add a custom SAML app. Enter the ACS URL and Entity ID provided by lien.to. Under attribute mapping, map the primary email field to an attribute named email. Download the IDP metadata file to import it into lien.to.
Access from your company portal
To prevent replay attacks, authentication must be initiated from lien.to (SP-initiated). To provide access from your company application portal (Okta, Microsoft My Apps, or Google launcher), configure a bookmark tile (_Bookmark App_) pointing directly to the lien.to SSO sign-in page.