SSO & SCIM Provisioning

Managing users manually is error-prone and time-consuming. RunEnv Enterprise supports Single Sign-On (SSO) and SCIM 2.0 automated provisioning, allowing you to manage RunEnv access directly from your Identity Provider (IdP).

Supported Identity Providers

RunEnv supports any SAML 2.0 or OpenID Connect (OIDC) compatible provider, including:

Okta
Microsoft Entra ID (Azure AD)
Google Workspace
JumpCloud
Ping Identity

Single Sign-On (SSO)

When SSO is enabled for your organization, users can authenticate to the RunEnv Dashboard and CLI using your corporate credentials.

Configuration

In the RunEnv Dashboard, go to Organization Settings > Authentication.
Select SAML or OIDC.
Input your IdP's Metadata URL or Issuer URL.
Provide the Client ID and Secret (for OIDC).
Map the necessary attributes (Email, Name).

Once configured, you can enforce SSO, preventing users from logging in with email/password or personal social accounts.

SCIM 2.0 Provisioning

While SSO handles authentication (who is this user?), SCIM handles authorization and lifecycle management (what can they access, and should they still have access?).

Automated Onboarding and Offboarding

With SCIM enabled, when you add a user to the "Engineering" group in Okta, they are automatically provisioned in RunEnv and added to the corresponding team. When they leave the company and are deactivated in Okta, their RunEnv access is instantly revoked.

SCIM Endpoints

RunEnv exposes standard SCIM 2.0 endpoints for your IdP to connect to:

GET /api/org/[orgId]/scim/Users
POST /api/org/[orgId]/scim/Users
PATCH /api/org/[orgId]/scim/Users/[id]
GET /api/org/[orgId]/scim/Groups

To set up SCIM, generate a SCIM Bearer Token in the RunEnv dashboard and provide it to your IdP along with the base URL.