SAML Single Sign-On

Which values belong in the IdP?

The Cremit SAML creation form shows an ACS URL based on the provider ID and the current platform origin, plus the SP entity ID. Copy those exact values into the IdP app. The current ACS path is /api/auth/sso/saml2/sp/acs/{providerId}. Older callback URLs may still be accepted for existing connections, but they are not the value to use for a new setup. Do not assemble an ACS URL from an old guide or assume a fixed host.

The form asks for the email domain, IdP entity ID, IdP SSO URL, signing certificate and signature algorithm. SHA-256 is the default. The current form does not offer an IdP metadata-XML paste or a Test Login button. If your IdP supplies metadata XML, read the required fields from it and enter them separately.

Create the provider and verify the domain

In Cremit Platform, open the organization’s SSO integration and add a SAML provider. Choose a unique lowercase provider ID, enter the email domain, and copy the displayed ACS and entity ID into the IdP app. Set the IdP app to send an email-address NameID and signed assertions, then enter its entity ID, SSO URL and current certificate in Cremit. Save the provider.

Check the provider row for domain-verification status. If it is unverified, follow its Verify Domain link and complete the organization’s domain-verification step before relying on email-domain routing. Creating a provider alone does not prove that sign-in is available for that domain.

Test sign-in and investigate failure

With a test account assigned to the IdP app, start sign-in from Cremit using that account’s verified email domain. Confirm that the IdP authenticates the user and that Cremit returns to a usable session. Check the provider, domain status and IdP sign-in event if the attempt fails. An Okta app tile can trigger a restart into an SP-initiated flow; this is not a promise that unsolicited SAML responses are accepted directly.

For an assertion recipient or destination error, compare the ACS in the IdP with the value shown by Cremit. For signature errors, check the current IdP signing certificate and configured algorithm. If an IdP certificate rotates, update the stored certificate and test sign-in again. Avoid fixed clock-skew or setup-time promises: diagnose the error reported by the actual sign-in attempt.

Primary documentation

Better Auth SAML endpoint and setup documentation

Better Auth 1.7 ACS migration

Cremit integrations