Setting up Single Sign-On (SSO)

What do I need to know about JIT provisioning in Spekit?

Spekit supports Just-in-Time (JIT) provisioning. Here are the key things to understand before getting started:

1. When the SSO configuration for Spekit is started using JIT, only the SAML portion is complete - SCIM is not required.
2. With JIT configured, user accounts are created automatically on first login, but user management in Spekit is handled manually by Spekit Account Admins.
   📌 Example: If someone leaves your company, their Spekit account must be manually disabled - JIT cannot automatically remove users.
3. Accounts are created upon a user's first login.
   📌 Example: When a user is assigned the Spekit app in Okta and clicks the Spekit tile for the first time, their Spekit account is created automatically at that moment.
4. Teams (referred to as Groups in some IdPs) must be created and managed by users with the Spekit Account Admin role.
5. Accounts provisioned with JIT are added to the default All Spekit Users team with Viewer permissions. Spekit Account Admins manage access to any additional custom teams manually.
6. There are multiple ways for users to sign into the Spekit Chrome Extension - the SSO IdP administrator can decide how to direct users.
7. Users do not need to constantly re-authenticate to the Chrome Extension once they've logged in.
8. The IdP administrator must assign the Spekit tile in their IdP (e.g. Okta) to any users who need access to Spekit.

Which Identity Providers does Spekit support?

How do I get access to the SSO/SCIM setup option?

The SSO/SCIM option must be enabled by the Spekit team before it will appear in your account. To request this, contact your Customer Success Manager or email support@spekit.co.

Once enabled, the Connect with SSO/SCIM button will appear on the Connect page in your Spekit Web App under Settings → Connect.

How do I start the SSO/SCIM configuration process in Spekit?

Once SSO/SCIM is enabled in your Spekit instance, follow these steps:

1. Go to the Spekit Web App and click Settings.
2. Click Connect.
3. Click Connect with SSO/SCIM.
4. Click Download to download the user mapping Excel sheet.
5. Review the Excel sheet - do not rename the file. Follow these rules when editing:
   • Do not modify anything in columns A or B.
   • Only make necessary edits to column C, which contains the email address from your company's IdP.
6. Click Choose File, select your updated Excel file, then click Upload.

What should I understand about the SSO experience in Spekit?

Once SSO is configured, users can log in to Spekit using either of the following methods:

• IdP-Initiated Login: Users click the Spekit tile directly from within their IdP's application directory (e.g. Okta, Azure). This is the most common and seamless method.
• SP-Initiated Login: Users go to the Spekit login page and enter their email address to be redirected to their IdP for authentication.