Group SSO FAQs
Find answers to common questions about Overleaf Group SSO.
How do I set it up?
If you’re the administrator of an Overleaf Pro group subscription, group SSO is one of the optional features you can turn on for your group. To set up group SSO your users must be set up in an Identity Provider (IdP) that supports SAML 2.0, and you must be able to add Overleaf as a Service Provider in your IdP. See the Setting up Group SSO guide for the steps to follow.
Do you support Just in Time (JIT) Provisioning of user accounts?
Yes. Overleaf accounts are provisioned by users who receive email invitations to join their account to the group and link to their SSO identity.
Do you support SCIM?
Individual users provision their own Overleaf accounts, System for Cross-domain Identity Management (SCIM), is a standard for automation of user provisioning. Because your system will not be provisioning users in Overleaf, SCIM isn’t supported or required.
Do you support SP or IdP initiated flows?
Overleaf Group SSO only supports Service Provider (SP) initiated flows. Identity Provider (IdP) initiated flows are not supported. If your IDP provides a launch menu, you may be able to set your main Overleaf application as "hidden" and configure a second "bookmark application" for your launch menu which points to the main Overleaf SSO login page: https://www.overleaf.com/sso-login.
Does Overleaf Group SSO support signed assertions and/or responses?
Yes, Overleaf Group SSO supports your Identity Provider signing assertions or responses, and requires that either the assertion or the entire response is signed. Optionally both may be signed, but this is not required.
The customer's Identity Provider (IdP) signs the SAML assertion or the entire response using its private key. Overleaf uses the IdP's public certificate to verify this signature.
Does Overleaf Group SSO support encrypted assertions?
Yes, Overleaf Group SSO supports IdP encrypted assertions using Overleaf's public certificate. Assertion encryption is not required, but is supported.
Your Identity Provider uses Overleaf's public certificate to encrypt the assertion. Only Overleaf, possessing the corresponding private key, can decrypt and read the encrypted data that is sent to us.
Does a user need to be created in our IdP before they create an Overleaf account?
If your subscription has SSO enabled, it’s best to have users created in your IdP before they’re invited to join the subscription. This allows users to create their Overleaf accounts, link to their SSO identity, and join your subscription in one step. However, this is not required, as your team members can link their Overleaf account to their SSO identity at any time.
If I delete a user in my identity system, will their Overleaf account be deleted?
No. Deleting a user in your IdP will not delete their account in Overleaf. Overleaf accounts are deleted in Overleaf by the account owner. This is either the user themselves or the manager of the account (when Managed Users is enabled).
Can SSO be made an exclusive login option?
Yes. If your group uses our Managed Users feature, the managed user accounts will be set to use SSO exclusively. See Linking users to Group SSO. Users will have to create a temporary Overleaf-specific password during the account creation and SSO linking process. For each user, SSO will become exclusive once they have linked their SSO identity to their Overleaf account and accepted the invitation to have their account managed. Administrators can check on the management and SSO status of each account on their group administration page.
I'm seeing an error when I try to log in—what do I do?
Please see Logging in with group single sign-on for troubleshooting suggestions. If you’re still having problems, please notify your group administrator and contact us if the issue cannot be resolved by them.
Last updated
Was this helpful?