SSO, SAML, and SCIM
Connect Clearly AI to your identity provider.
Clearly AI uses PropelAuth for enterprise SSO and SCIM.
Use SSO when users sign in through your identity provider. Use SCIM when your identity provider creates, updates, and deactivates Clearly AI users automatically.
Supported identity providers
Clearly AI supports SAML SSO through PropelAuth. PropelAuth provides guided setup for Okta, Microsoft Entra ID, Google, OneLogin, JumpCloud, Duo, Rippling, and generic SAML providers.
SCIM is available through PropelAuth for Okta, Microsoft Entra ID, OneLogin, and JumpCloud.
Who should be involved
Enterprise SSO setup usually needs both product and identity owners:
- Your Clearly AI tenant URL.
- A Clearly AI Owner or Admin.
- An identity provider or IAM admin who can configure the SAML application.
- The email domains allowed into your organization.
- The default role or role mapping you want Clearly AI users to receive.
Large organizations often have a separate SSO or IAM team that owns the final IdP configuration. Include them early if your app owner cannot change SAML certificates, assertion signing, user assignment, or role/group mappings.
Information exchanged during SAML setup
Clearly AI and PropelAuth provide the setup link and SAML service provider values, including the ACS URL and SP Entity ID. Some IdPs ask for service provider metadata XML or an SP certificate. If your IdP requires either one, ask Clearly AI before your IdP admin finishes the setup so we can confirm the exact field and format.
Your IdP admin provides the identity provider values back through the PropelAuth setup flow:
- IdP SSO URL.
- IdP Entity ID or Issuer.
- IdP signing certificate.
- User attribute mappings, usually email, first name, and last name.
- Role or group mappings, if your IdP should manage Clearly AI roles.
Set up SAML SSO
Request enterprise SSO
Ask Clearly AI to enable Enterprise SSO for your organization and generate a SAML setup link. The link is time-limited and can be shared with the identity provider admin who will complete the setup.
Open the PropelAuth setup guide
Choose your identity provider in the setup guide. If your provider is not listed, use the generic SAML guide.
Configure Clearly AI as the service provider
In your IdP, enter the ACS URL and SP Entity ID from the PropelAuth guide. If your IdP asks for service provider metadata XML or an SP certificate instead of direct URL entry, pause and ask Clearly AI for the right value.
Map user attributes
Map email, first name, and last name. If your IdP asks for a NameID format, use urn:oasis:names:tc:SAML:2.0:nameid-format:persistent unless your Clearly AI contact gives different guidance for your provider.
Enter IdP values in PropelAuth
In the PropelAuth setup guide, enter the IdP SSO URL, IdP Entity ID or Issuer, and IdP signing certificate. These values must match what the IdP sends in the SAML assertion.
Test with an assigned user
Assign one test user to the SAML app in your IdP, then test login from your Clearly AI tenant URL. If your IdP has separate QA and production apps, test the same configuration path in each environment before broad rollout.
After SSO is enabled, users in the organization sign in through the configured identity provider.
Map roles from your IdP
Decide role behavior before broad rollout. If the IdP does not send a role, new users may receive the default member role and need manual reassignment after first login.
PropelAuth supports SAML role mapping through provider-specific guides. Common patterns are:
- Send a role attribute with a Clearly AI role value, such as
Owner,Admin, orMember. - Send a group named for the role, such as
role_Owner, when your IdP uses group-based role mapping.
If you want a limited role such as chat-only access for new users, configure that mapping in your IdP before inviting a large group. This avoids a window where users sign in with broader access than intended.
Set up SCIM
Set up SCIM after SSO works. PropelAuth requires Enterprise SSO to be enabled before SCIM can be enabled.
Ask Clearly AI to enable SCIM
Clearly AI enables SCIM for your organization after SSO is configured.
Open the PropelAuth SCIM guide
Open the SCIM setup guide from your organization settings. PropelAuth provides provider-specific instructions for supported IdPs.
Configure provisioning in your IdP
Enter the SCIM connection details in your IdP and assign one test user to the Clearly AI application.
Test the user lifecycle
Provision the test user, confirm the user appears in Clearly AI, update any mapped profile or role fields, then deactivate or unassign the user in your IdP and confirm access is removed.
SCIM controls provisioning. Users still sign in through SSO.