Single sign-on (SAML SSO)
Enterprise organizations can let people authenticate to Mindsmith through a SAML identity provider. An organization Admin configures SSO under Settings → Security in Organization Settings.
SSO handles sign-in, not organization membership. A person's first successful SAML sign-in can create their Mindsmith account, but it does not by itself add them to the organization. Add people to the organization by invitation or, when available, Directory Sync. Assign an author seat in Mindsmith if a person needs to create content.
Configure your identity provider
Open the service-provider configuration page for your region:
US:
https://app.mindsmith.ai/.well-known/saml-configurationEU:
https://eu.mindsmith.ai/.well-known/saml-configuration
That page provides the current entity ID, assertion consumer service URL, response and signature requirements, encryption certificate, and downloadable service-provider metadata. Use those values to create a SAML application in your identity provider.
Download or copy the identity provider’s metadata XML after its SAML application is ready.
Add the provider to Mindsmith
Open Settings → Security in the Enterprise organization.
Select Add SAML Provider.
Paste the identity provider metadata XML.
Select Save Configuration.
Under Authorized Domains, add each email domain that should use this provider.
The domain should be entered without an email address or protocol, such as example.com. You can edit the provider metadata later or remove a provider or domain from the same page.
Email claim
Mindsmith identifies a person by email address. Configure the SAML application to send the person’s real email address in the mail attribute, especially if the provider’s username, UPN, or NameID is different from the email used in Mindsmith.
If no valid email address is present, sign-in cannot complete. The address also determines which Mindsmith account is used, so it should match the address used for the person’s invitation or directory record.
How people sign in
Open the Mindsmith SSO sign-in page.
Enter a work email address.
Select Continue with SSO.
Complete authentication with the organization’s identity provider.
Mindsmith uses the email domain to choose the configured provider and the correct US or EU region.
Launch from an identity-provider portal
An identity-provider bookmark or application tile can begin the same service-provider-initiated flow:
https://app.mindsmith.ai/auth/sso/launch?domain=example.com
Use eu.mindsmith.ai for an EU organization. Replace example.com with a domain already listed under Authorized Domains.
To return a person to a particular Mindsmith page after sign-in, add a relative callbackUrl, for example:
https://app.mindsmith.ai/auth/sso/launch?domain=example.com&callbackUrl=/dashboard
Only paths within Mindsmith are accepted. This launch link starts a service-provider-initiated SAML flow; unsolicited identity-provider-initiated assertions are not the supported launch method.
Troubleshooting
The email domain is not recognized: confirm it is listed under Authorized Domains for the provider.
An unexpected email or account is used: verify that the SAML
mailattribute contains the person's intended work email and matches any invitation or directory record.A person signs in but cannot see the organization: invite or provision the person into that organization and confirm the membership is active.
The provider certificate or endpoints changed: update the provider with fresh metadata XML.
The user lands in the wrong region: use the configuration and launch URLs for the organization’s region; Mindsmith also attempts to route recognized domains correctly.
For attribute mapping and identity-provider setup guides, see the BoxyHQ SSO documentation.