Skip to main content

​
Google SSO

This guide provides step-by-step instructions for Google Workspace administrators to enable Google Single Sign-On (SSO) for access to Inflection’s web portal.
  • Google Workspace administrator account with super admin privileges
  • A verified domain in Google Workspace
  • User accounts set up in Google Workspace
  1. Open Google Admin console (https://admin.google.com) → Apps → Web and mobile apps → Add app → Add custom SAML app
  2. App details
    • Name: Inflection
    • (Optional) Description and logo
    • Click Continue
  3. Download IdP info (from the Google IdP Information step)
    • Either Download Metadata or copy:
      • SSO URL (a URL like https://accounts.google.com/o/saml2/idp?idpid=...).
      • Entity ID / Issuer (Google shows a similar URL).
      • Certificate (X.509). You will paste this in Inflection later.
    • Click Continue
  4. Service provider details
    • ACS URL: https://auth.inflection.io/api/v1/saml/sso2
    • Entity ID: https://auth.inflection.io
    • Start URL: (leave blank)
    • Signed response: Checked
    • Name ID format: Email
    • Name ID: Basic Information → Primary email
    • Click Continue
  5. Attribute mapping (Add Mapping)
  6. Save
  7. Turn on for users
    • On the app’s main page, click User access and turn ON for everyone or for specific users/Groups.
In Inflection, navigate to Settings > Single Sign-on.In the Single Sign-on section, enable SAML. Then enter:
  • Single sign-on URL: This is the SSO URL from the google admin page, typically of the form https://accounts.google.com/o/saml2/idp?idpid=xxxxxxxxx
  • Issuer: This is the Entity ID entry from the google admin page, typically of the form accounts.google.com
  • Certificate: Paste the contents of the certificate downloaded from google. Note: Ensure that the contents start with ---BEGIN CERTIFICATE--- and end with --END CERTIFICATE-- for it to be parsed properly
  • Click Save Inflection Single Sign-on settings with SAML enabled, showing the single sign-on URL, issuer, and certificate fields

​
Step 1: Set Access Controls

  1. Specify which user groups can access the application in Google admin console
  2. Define role-based access if applicable

​
Step 2: Test the Configuration

  1. Test the SSO setup with a test user account before rolling it out to all users
  2. Verify that the user can use sign-up with Google on app.inflection.io, log in with their google credentials and see a fully populated inflection homepage on successful login

​
Step 3: Deploy to Users

  1. Once testing is successful, deploy the SSO configuration to all intended users
  2. Monitor for any authentication issues during the initial rollout
  • app_not_configured_for_user
    • The user isn’t assigned to the SAML app. Turn the app ON for that user’s Organizational Unit or group.
  • Audience / Entity ID mismatch
    • Ensure Entity ID in Google is exactly https://auth.inflection.io (no trailing slash). Re‑save and try again.
  • Recipient / ACS mismatch
    • Ensure ACS URL is exactly https://auth.inflection.io/api/v1/saml/sso2.
  • Response is not signed
    • In the SAML app → Service provider details, ensure Signed response is checked (this guide assumes it is ON).
  • Attribute issues
    • Attribute mappings must include: Primary email → email, First name → name.
  • Clock/time errors (rare scenario)
    • Ensure devices and IdP time are in sync.

​
What Inflection receives

  • NameID: the user’s primary email
  • Attributes:
    • email: user’s primary email
    • name: user’s first name

​
Okta SSO

This guide provides step-by-step instructions for Google Workspace administrators to enable Okta Single Sign-On (SSO) for access to Inflection’s web portal.
This setup might fail without parameter values that are customized for your organization. Please use the Okta Administrator Dashboard to add an application and view the values that are specific for your organization.
Enabling SAML will affect all users who use this application, which means that users will not be able to sign in through their regular sign-in page. They will be able to access the app through the Okta service.Inflection.io doesn’t provide a backup sign-in URL where users can sign in using their regular username and password. You can contact Inflection.io Support (team@inflection.io) to turn off SAML, if necessary.
The Okta/Inflection.io SAML integration currently supports the following features:
  • SP-initiated SSO
  • IdP-initiated SSO
  • JIT (Just In Time) Provisioning
For more information on the listed features, visit the Okta Glossary.The following SAML attributes are supported:
  1. From the Okta Admin dashboard, click Admin button
  2. Click Applications > Applications
  3. Click Browse App Catalog
  4. Search for and Select Inflection in Browse App Integration Catalog
  5. Click Add Integration and Click Done
  6. Under Assign tab, add the Okta users that must be granted access to Inflection and Save
  7. Click Sign On tab, then click Edit.
  8. Encryption Certificate: Save the following encryption certificate as encryption.crt then upload it to Okta.
  9. Scroll down to Advanced Sign-on Settings.
  10. Enter your Organisation Slug (Get it from inflection app → Settings page → Single Sign-on) into the corresponding field.
  11. Application username format: Select Email.
  12. Click Save.
  13. Done!
  1. Login to inflection account
  2. Navigate to Settings
  3. Choose Single Sign-on
The values for the following settings can be found on the Sign On tab of the Inflection Okta Application under “Metadata Details”
  • Single Sign-On URL
  • IDP Issuer
  • Certificate Inflection Single Sign-on settings showing the single sign-on URL, IDP issuer, and certificate fields
  • Single Sign-On URL: Copy and paste the following:
    Sign On tab of the Inflection Okta Application under “Metadata Details” >> Sign on URL
  • IDP Issuer: Copy and paste the following:
    Sign On tab of the Inflection Okta Application under “Metadata Details” >> Issuer
  • Certificate: Copy and paste the following:
    Sign On tab of the Inflection Okta Application under “Metadata Details” >> Signing Certificate
  • Click Save Changes.
  • Logout
  • And log back In. This time Okta SSO login will be prompted
  1. Go to: https://app.inflection.io/login/start
  2. Enter your email, then click Continue