Skip to main content
Denada supports SAML-based single sign-on (SSO), allowing your team members to sign in using your organization’s identity provider (IdP) such as Okta, Azure AD, Google Workspace, or OneLogin.
SAML 2.0 is the only supported protocol. Denada does not support OpenID Connect (OIDC), and a “bookmark app” style tile won’t work either — it only links to a URL and never sends us an assertion. If your IdP intake form asks you to pick an application type, choose SAML 2.0.
SSO setup requires manager permissions on your team.

​
Prerequisites

Before you begin, make sure you have:
  • A Denada team with manager-level access
  • Administrator access to your organization’s identity provider (IdP)
  • Your IdP’s SAML metadata XML (provided by your IdP)

​
Step 1: Get Denada’s service provider details

When configuring your identity provider, you’ll need the following details about Denada: Your IdP may also refer to the ACS URL as the “Reply URL” or “Single sign-on URL.” Note that the Audience URI is https://heydenada.com — the marketing site, not the app or cloud hostname. It’s an identifier rather than an address, so it doesn’t need to be a URL anyone visits.
Leave Relay State empty. Denada reserves it for deep-linking a viewer back to a specific shared project, and a plain word like Denada will be read as a project ID and land every SSO user on a broken share page. If your IdP requires a value, use a full URL such as https://app.heydenada.com — it’s ignored safely and users arrive at the app home page.
Most identity providers allow you to import settings automatically from a metadata URL. Try pasting the SP metadata URL above into your IdP’s configuration to auto-populate the required fields.

​
Step 2: Configure your identity provider

The exact steps vary depending on your IdP, but generally you’ll need to:
  1. Create a new SAML application in your IdP.
  2. Enter the ACS URL and SP metadata URL from the table above.
  3. Set the NameID format to email address.
  4. Assign users or groups that should have access to Denada.
  5. Copy the IdP metadata XML — you’ll need this for the next step.
  1. In the Okta admin console, go to Applications > Applications > Create App Integration.
  2. Select SAML 2.0 and click Next.
  3. Enter “Denada” as the app name and click Next.
  4. Set the Single sign-on URL to https://cloud.heydenada.com/api/saml/callback.
  5. Set the Audience URI (SP Entity ID) to https://heydenada.com.
  6. Leave Default Relay State blank.
  7. Set Name ID format to EmailAddress and Application username to Email.
  8. Under Attribute Statements, add email, firstName, and lastName (mapped to user.email, user.firstName, and user.lastName). These are optional, but without them new accounts are created with no name.
  9. Click Next, then Finish.
  10. Go to the Sign On tab and click View SAML setup instructions or Identity Provider metadata to copy the metadata XML.
  1. In the Azure portal, go to Enterprise Applications > New application > Create your own application.
  2. Name it “Denada”, select Integrate any other application, and click Create.
  3. Go to Single sign-on > SAML.
  4. Under Basic SAML Configuration, set the Reply URL (ACS) to https://cloud.heydenada.com/api/saml/callback.
  5. Set the Identifier (Entity ID) to https://heydenada.com.
  6. Under User Attributes & Claims, ensure the NameID is set to user.mail.
  7. Download the Federation Metadata XML from the SAML Signing Certificate section.
  1. In the Google Admin console, go to Apps > Web and mobile apps > Add app > Add custom SAML app.
  2. Name it “Denada” and click Continue.
  3. Copy the IdP metadata from the Google IdP information page (you’ll paste this into Denada).
  4. Set the ACS URL to https://cloud.heydenada.com/api/saml/callback.
  5. Set the Entity ID to https://heydenada.com.
  6. Set Name ID format to EMAIL.
  7. Click Finish, then turn the app ON for the relevant organizational units.

​
Step 3: Configure SSO in Denada

  1. Open Settings in the Denada app.
  2. Scroll to the Single sign-on section and click Setup SSO.
SSO setup button in settings

The SSO settings panel before configuration.

  1. Paste your IdP metadata XML into the IdP metadata field. Denada will validate the metadata and display the detected issuer.
SSO configuration dialog

The SSO configuration dialog with IdP metadata.

  1. Optionally, enable Auto-add new users to team — when turned on, any user who signs in via SSO will automatically be added as a member of your team.
  2. Click Save.
Once saved, your team members can sign in using your identity provider. The Single sign-on panel will show SSO Configured along with the detected issuer.
SSO configured state showing issuer

SSO successfully configured.

​
How SSO login works

SSO logins start at your identity provider, not at Denada. Users click the Denada tile on their IdP dashboard (their Okta or Azure “My Apps” home page), and:
  1. The IdP authenticates them and posts a SAML response to Denada.
  2. Denada matches the assertion’s issuer to your team’s saved metadata and validates the signature.
  3. The user is identified by the email attribute, or by the NameID when it’s in email format.
  4. Denada signs them in, creating an account if this is their first visit.
  5. If auto-add is enabled, new users are automatically added to your team.
There is no “Sign in with SSO” button on the Denada sign-in page — send your users to the tile on their IdP dashboard instead. The one exception is a restricted share link: when someone opens a restricted project belonging to an SSO-enabled team, that page does offer to sign them in through your IdP.

​
Troubleshooting

Make sure you’re pasting the complete IdP metadata XML, starting with <?xml and ending with </md:EntityDescriptor> or </EntityDescriptor>. Some IdPs provide a download link rather than displaying the XML directly — use that to get the full content.
This typically means the metadata XML was saved but couldn’t be fully parsed. Click the SSO configuration to re-open the dialog, and re-paste the metadata from your IdP. Ensure there are no extra spaces or truncated content.
Verify that the Auto-add new users to team toggle is enabled in the SSO configuration dialog. Users who haven’t yet created a Denada account will receive an invitation when they first sign in via SSO.
Denada identifies users by email address. Set the NameID format to EmailAddress (so the NameID is the user’s email), or add an email attribute to the assertion. An assertion carrying only an opaque or username-style NameID can’t be matched to an account.
This means the issuer in the SAML response doesn’t match any configured SSO setup. Double-check that the Entity ID / Issuer in your IdP matches what Denada detected when you pasted the metadata.

​
Need help?

If you run into issues setting up SSO, reach out to support@heydenada.com or ask in our Community Slack.