Single Sign-On (SSO)
Available on request
SSO is not self-serve. To enable it for your organisation, contact team@lumicast.com.
Single Sign-On (SSO) lets your team log in to Lumicast using your company's existing identity provider (IdP) — such as Okta, Microsoft Entra ID (Azure AD), or any SAML 2.0-compatible provider. No separate Lumicast password needed.
How it works
Lumicast uses SAML 2.0 for SSO. Once configured for your organisation:
- A team member goes to app.lumicast.com/login/sso and enters their work email address
- Lumicast detects the domain (e.g.
example.com) and redirects to your identity provider - The user authenticates with your IdP (password, MFA, etc. — whatever your IdP requires)
- Your IdP sends a SAML assertion back to Lumicast
- Lumicast logs the user in
SSO does not create accounts: invite each team member first. On their first SSO login, the account is matched by email address and linked automatically. Someone who hasn't been invited sees You have not been invited to Lumicast yet.
What Lumicast needs from you
To set up SSO, provide the following to team@lumicast.com:
| Field | Description |
|---|---|
| Domain | The email domain that should trigger SSO (e.g. example.com) |
| Metadata URL | A public https:// URL to your IdP's SAML metadata XML (redirects are not followed) |
| Issuer | Optional — a custom entity ID for Lumicast, if your IdP requires a specific one |
What your IdP needs from Lumicast
When configuring the SAML app on your identity provider's side, use:
- ACS URL (Assertion Consumer Service):
https://api.lumicast.com/auth/saml/callback - Entity ID / Audience:
https://lumicast.com/sp(or the custom Issuer you provided)
Your IdP must send a nameID and the user's email address — either as the nameID in emailAddress format, or in an email or mail attribute. firstName and lastName attributes are used if provided.
Logging in with SSO
Direct your team to app.lumicast.com/login/sso. They enter their work email and are redirected to your IdP automatically. The standard email/password login page still works for accounts not covered by SSO.