> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/cline/cline/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO setup

> Configure Single Sign-On for Cline Enterprise using SAML or OIDC with Okta, Microsoft Entra ID, Google Workspace, or Keycloak.

Cline Enterprise uses [WorkOS AuthKit](https://workos.com/docs/authkit/sso) to connect your identity provider (IdP) to the Cline platform. This page covers how SSO is configured, where each part of setup happens, and how to verify and troubleshoot the connection.

<Info>
  If you have not completed initial onboarding, start with the [Onboarding guide](/enterprise/onboarding) first. Your designated admin must accept the WorkOS invitation before SSO can be configured.
</Info>

## Where setup happens

SSO configuration spans two interfaces:

| Interface                                                    | What you do there                                                                  |
| :----------------------------------------------------------- | :--------------------------------------------------------------------------------- |
| **WorkOS dashboard**                                         | Configure your IdP connection (SAML/OIDC credentials, redirect URIs, certificates) |
| **Cline dashboard** ([app.cline.bot](https://app.cline.bot)) | Sign in, verify SSO works, and manage your organization                            |

Your IdP administrator accesses the WorkOS dashboard via the invitation email sent during enterprise onboarding.

## Configuring your IdP connection in WorkOS

<Steps>
  <Step title="Open the WorkOS dashboard">
    Open the WorkOS invitation email sent to your designated admin during onboarding and follow the link to your organization's WorkOS dashboard.
  </Step>

  <Step title="Add an IdP connection">
    1. In the WorkOS dashboard, go to **AuthKit → Connections**.
    2. Click **Add Connection**.
    3. Select your identity provider from the list.

    WorkOS supports the following providers natively:

    <CardGroup cols={2}>
      <Card title="Okta" icon="circle-check">
        SAML 2.0 or OIDC. Follow the WorkOS Okta guide for the required app settings and attribute mappings.
      </Card>

      <Card title="Microsoft Entra ID (Azure AD)" icon="circle-check">
        SAML 2.0 or OIDC. You will need your Entra tenant ID, client ID, and client secret.
      </Card>

      <Card title="Google Workspace" icon="circle-check">
        SAML 2.0. Requires a Google Workspace admin account to create the SAML app.
      </Card>

      <Card title="Generic SAML / OIDC" icon="circle-check">
        Use for Keycloak or any other SAML 2.0 or OIDC-compatible provider not listed above.
      </Card>
    </CardGroup>
  </Step>

  <Step title="Complete provider-specific configuration">
    WorkOS displays provider-specific instructions and required fields after you select your IdP. The configuration details vary by provider but generally include:

    <Tabs>
      <Tab title="SAML">
        * **SP Entity ID**: Provided by WorkOS — enter this in your IdP's SAML app.
        * **ACS URL (Assertion Consumer Service URL)**: Provided by WorkOS — enter this as the redirect/callback URL in your IdP.
        * **IdP SSO URL**: Your IdP's SAML endpoint — enter this in WorkOS.
        * **IdP Certificate**: Your IdP's signing certificate — upload or paste into WorkOS.
        * **Attribute mappings**: Map your IdP's user attributes (email, first name, last name) to the fields WorkOS expects.
      </Tab>

      <Tab title="OIDC">
        * **Redirect URI**: Provided by WorkOS — register this in your IdP's OIDC application.
        * **Client ID**: From your IdP's OIDC application — enter in WorkOS.
        * **Client Secret**: From your IdP's OIDC application — enter in WorkOS.
        * **Issuer URL**: Your IdP's OIDC discovery endpoint — enter in WorkOS.
      </Tab>
    </Tabs>

    For the exact fields and screenshots for each provider, follow the [WorkOS SSO documentation](https://workos.com/docs/authkit/sso).
  </Step>

  <Step title="Save the connection">
    Save the connection in WorkOS. The connection status should change to **Active** once your IdP is reachable and the credentials are valid.
  </Step>
</Steps>

## Keycloak

Keycloak is not listed as a named provider in WorkOS, but it is fully supported as a **Generic SAML** or **Generic OIDC** connection. Use the Keycloak realm's SAML or OIDC metadata to fill in the required WorkOS fields.

## Verifying the SSO connection

After saving the connection in WorkOS:

1. Navigate to [app.cline.bot](https://app.cline.bot) and attempt an SSO sign-in.
2. You are redirected to your IdP's login page.
3. Authenticate with valid credentials.
4. Confirm you are redirected back to Cline and your account details are correct.

A successful test confirms the full SSO flow is working end-to-end.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Redirect URI mismatch">
    The redirect or callback URL configured in your IdP must exactly match what WorkOS provided during setup (including protocol, domain, and path). A single character difference causes this error.

    **Fix:** Copy the ACS URL or Redirect URI directly from the WorkOS dashboard and paste it into your IdP without modification.
  </Accordion>

  <Accordion title="SAML certificate errors">
    An expired or incorrect certificate causes authentication failures.

    **Fix:** Download the current signing certificate from your IdP and re-upload it to WorkOS. Verify the certificate expiry date in your IdP.
  </Accordion>

  <Accordion title="Attribute mapping failures">
    If users are created without a name or email, or with an incorrect role, the IdP is not sending the expected attributes.

    **Fix:** In WorkOS, verify that the attribute mappings for email, first name, and last name match the attribute names your IdP sends in the SAML assertion or OIDC token.
  </Accordion>

  <Accordion title="Connection shows as inactive">
    WorkOS marks a connection inactive if it cannot reach your IdP's metadata endpoint or the credentials are invalid.

    **Fix:** Verify that the issuer URL (OIDC) or IdP SSO URL (SAML) is reachable from the public internet, and that the client secret or certificate has not expired.
  </Accordion>
</AccordionGroup>

For additional troubleshooting, see the [WorkOS SSO documentation](https://workos.com/docs/authkit/sso) or contact [Cline support](mailto:support@cline.bot).