BugmoleDocs bugmole.com →

Single sign-on and SCIM

Business and Enterprise workspaces can have people sign in through their company's identity provider, such as Okta, Microsoft Entra ID or Google Workspace. Enterprise also includes SCIM, so the identity provider adds and removes people for you.

Workspace owners and admins set this up in Resource management → Single sign-on.

1. Turn it on

Open Single sign-on and choose Set up single sign-on. This links the workspace to your organization in Aegis, Bugmole's sign-in service.

2. Verify your email domains

Add each domain your people sign in with, such as acme.com. Bugmole shows a DNS TXT record for each one:

Record Value
_aegis-org-verify.acme.com the value shown on the page

Add the record at your DNS provider, then choose Check DNS. DNS changes can take a few minutes. Once a domain is verified, anyone who types an address on it at sign-in is sent to your identity provider.

3. Add your identity provider

Choose SAML 2.0 or OpenID Connect and give the connection a name. Bugmole then shows what to enter in your identity provider.

SAML 2.0

  1. Create a SAML app in your identity provider with:

    • ACS (reply) URL: shown on the page
    • Entity ID (audience): shown on the page
    • Name ID: a stable user identifier, such as the user ID or email
    • Attributes: email, plus displayName and groups if you have them

    Many providers can import the Metadata link instead.

  2. Back in Bugmole, fill in the provider's sign-in URL and paste its signing certificate.

  3. Choose Turn on.

Assertions must be signed. Sign-in always starts from Bugmole, so tiles in your identity provider's app launcher open the Bugmole sign-in page instead of signing people in directly.

OpenID Connect

  1. Create an OIDC web app in your identity provider with the redirect URI shown on the page. Ask for the openid, email and profile scopes, and add a groups claim if you want roles from groups.
  2. Back in Bugmole, fill in the issuer URL, client ID and client secret.
  3. Choose Turn on.

Your identity provider may only sign people in with addresses on your verified domains. Sign-ins for any other address are refused.

4. Choose roles

People who sign in through your identity provider join the workspace automatically. Under Roles, map groups to roles, one per line:

QA Leads = admin
Engineering = member
Finance = billing

Roles update each time someone signs in, and straight away when SCIM changes their groups.

5. Require single sign-on

When Require single sign-on is on, people with an address on a verified domain can only sign in through your identity provider. Email links, passwords, passkeys and social sign-in are turned off for them. You can turn this on once a domain is verified and an identity provider is on.

SCIM provisioning (Enterprise)

  1. Under SCIM provisioning, choose Create SCIM token. Copy it now: it's only shown once.
  2. In your identity provider, turn on SCIM 2.0 provisioning with:
    • Base URL: shown on the page
    • Authentication: bearer token, using the token you copied

Your identity provider can then:

Supported: users and groups, eq filters on userName, externalId and displayName, and PATCH. Bulk operations aren't supported.

You can have up to five tokens at once. Revoke a token to stop provisioning with it.

If your plan changes

If a workspace moves to a plan without single sign-on or SCIM, owners get an email and the feature keeps working for 14 days. After that, people sign in with an email link again and SCIM stops. Your settings are kept, so upgrading turns everything back on.

Troubleshooting