Enforce single sign-on for your Meridian workspace - SAML 2.0 setup with Okta, Entra ID, and Google, plus domain enforcement.
Workspaces on the Team plan and above can enforce SSO - members authenticate through your identity provider instead of Meridian credentials. SAML 2.0 is supported natively; OIDC via your IdP's SAML bridge.
| IdP | Support |
|---|---|
| Okta | Native SAML app in the OIN |
| Microsoft Entra ID (Azure AD) | Enterprise application SAML |
| Google Workspace | Custom SAML app |
| Any SAML 2.0 IdP | Manual metadata configuration |
Point it at Meridian's service provider:
| Field | Value |
|---|---|
| ACS URL | https://auth.meridian.dev/saml/acs |
| Entity ID / Audience | https://meridian.dev/saml |
| NameID format | emailAddress |
Required attributes: email, firstName, lastName.
Dashboard → Settings → Security → SSO: paste your IdP's metadata URL or XML. We pull the SSO URL, entity ID, and signing certificate automatically.
Test sign-in with one account before enforcing. When it works, enable Require SSO - members must then authenticate via your IdP; password logins are disabled for your domain.
Claim your email domain(s) under Settings → Security → Domains. Once verified:
Meridianacme.io, acme.com).Map IdP groups to Meridian roles - members get the right access on first login:
| IdP group | Meridian role |
|---|---|
meridian-admins | admin |
meridian-developers | developer |
meridian-viewers | viewer |
Unmapped members land at viewer - least privilege by default. Owners are never auto-assigned; transfer ownership manually.