Single sign-on & SCIM (Enterprise)

Single sign-on and SCIM are on the Enterprise plan. You configure them from Settings → SSO, and everything you paste into your identity provider (IdP) comes from that same page.

Before you start

• Your organization is on the Enterprise plan.
• You are an admin of your FolianX organization.
• You can administer your IdP (create a SAML application, manage users and groups).

Part 1 — Single sign-on (SAML)

1. Create a SAML application in your IdP

In JumpCloud, go to SSO Applications → Add New Application → Custom Application, then enable Manage Single Sign-On (SSO) with Configure SSO with SAML. (Tick Export users to this app too if you also want SCIM provisioning — Part 2.)

2. Point the app at FolianX

FolianX's Assertion Consumer Service (ACS) URL is:

https://folianx.com/sso/saml/acs

Enter a value of your choice for the SP Entity ID (for example folianx) — you'll put the same value into FolianX in step 5, so the two sides agree.

3. Set the subject, format and — importantly — the signature

• SAML Subject NameID: email
• NameID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
• Map the email attribute to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.

4. Assign your users

In JumpCloud, users get access to an application through a user group: create a group, add your members, and bind the group to the app on its User Groups tab.

5. Configure SSO in FolianX

Export the IdP metadata from your app and copy three values into Settings → SSO in FolianX:

• IdP Entity ID — the app's IdP Entity ID.
• IdP SSO URL — the app's SSO/login URL.
• IdP X.509 Certificate — the signing certificate, in PEM form.

Set the SP Entity ID to the same value you chose in step 2, then click Configure SSO.

6. Turn on Just-in-Time provisioning

Once the config is saved, tick Enable Just-in-Time user provisioning so a member who signs in for the first time gets a FolianX account automatically. Because a new member consumes a seat, you must also tick Auto-bill JIT-provisioned users — otherwise an unknown SSO user is refused with “Your account has not been provisioned.”

That's it — a bound user can now sign in via your IdP and land straight in their workspace.

Part 2 — Automatic provisioning (SCIM)

SCIM lets your IdP create, update and deactivate FolianX members automatically, so joiners and leavers are handled in one place.

1. Generate a SCIM token in FolianX

On Settings → SSO, in SCIM Provisioning Tokens, give the token a name, optionally set a max seats cap, and tick Allow auto-billing on user creation so provisioned users can claim a seat. Click Generate Token — the token is shown once, so copy it immediately.

2. Add provisioning in your IdP

On the app's Provisioning tab, choose SCIM API with Bearer token authentication and enter:

• Base URL: https://folianx.com/scim/v2
• Token Key: the SCIM token you just generated.

3. Test and activate

Run Test Connection; once it passes, Activate. Provisioning then goes live — members added to the app in your IdP are created in FolianX, updates flow through, and removing a member deactivates their FolianX account.

Troubleshooting

Symptom	Fix
“SSO authentication failed: invalid response.”	Set the IdP to sign the Assertion (see the callout in step 3), and check the SP Entity ID matches on both sides.
“Your account has not been provisioned.”	Enable Auto-bill JIT-provisioned users on the SSO config, or invite the user from Settings → Team.
SCIM “Test Connection” fails	Confirm the base URL is exactly https://folianx.com/scim/v2, the token is current, and the token has auto-billing enabled with headroom under its seat cap.

Still stuck? Contact us — include your IdP and the exact error and we'll help.