Verified Identity Providers
ngrok supports identity providers that support either SAML or OpenID Connect for SSO. The following table lists the identity providers that are verified to work with SSO for your ngrok account.| Identity Provider | Guides to get started |
|---|---|
| Okta | ngrok’s Dashboard SSO guide and SCIM provisioning |
| Microsoft AzureAD | ngrok’s Dashboard SSO with SAML guide and the official documentation |
| Salesforce | ngrok’s Dashboard SSO with Salesforce OAuth and OIDC guide and the official documentation |
| Auth0 | ngrok’s Dashboard SSO with Auth0 SAML guide and the official documentation |
Enforcement
Your account sets an SSO Enforcement policy which controls whether users are required to log in with SSO. Mixed Mode: In mixed mode, users who existed on your account before you set up SSO may continue using their existing credentials to log in. All new users will be required to use SSO. SSO Enforced: In SSO enforced mode, all users must use your SSO IdP to log in and their existing credentials will no longer allow them to log into your account. Keep in mind that after you add an IdP, your account is still in Mixed Mode and users can continue to log in with their previous credentials. Once you are confident that your SSO integration is configured correctly, you can switch to SSO Enforced mode. This helps you avoid inadvertently locking yourself or your users out of the account.IdP-Initiated Login
ngrok supports IdP-initiated login flows for SAML IdPs. An IdP-initiated login flow is one in which users can log into your ngrok account by clicking on a link in your IdP’s dashboard. You may enable IdP-initiated login on a per-IdP basis. The OpenID Connect protocol does not support IdP-Initiated login so it is not supported for IdPs you connect that way.User Provisioning
When using SSO, you may configure how users are provisioned and deprovisioned from your ngrok account. You may configure your account to provision users in one of three modes:- Explicitly invited by an existing member of your account
- Just-in-time (JiT) provisioned after they successfully log in with SSO
- Managed via your IdP’s SCIM integration.
Multiple IdPs
You may configure multiple IdPs to use for SSO. If you do, when a user tries to log in, they will be presented with a choice of which provider to use to log in. The description provided when configuring the IdP in your account will be displayed to the user here and can be used to distinguish similar providers.SCIM
ngrok supports a limited subset of RFC 7644 to enable SCIM provisioning and deprovisioning. ngrok’s SCIM implementation works with major IdPs like Okta and Microsoft Entra ID. ngrok’s SCIM API Base URL is:userName, displayName, and active. The userName property must be mapped
to a user’s email address. The active property can be used to control whether
a user is disabled. displayName should be mapped to
a user’s full name.
Consult the SCIM Provisioning documentation for additional
details on how users are provisioned with SCIM.