SSO and role-based access

Available methods

• Email + password (all plans).
• Google Workspace (all plans).
• Microsoft Entra ID / Office 365 (Professional and above).
• SAML 2.0 — Okta, JumpCloud, OneLogin, generic SAML (Business plan).

Setting up SAML

1. 1Settings → Security → SSO → SAML.
2. 2Copy the ACS URL and Entity ID into your identity provider's app.
3. 3Download the IdP metadata XML and paste it back into Vibeshift.
4. 4Test with your own account before enforcing.
5. 5Enable 'Require SSO for this domain' to block password logins for your company's email domain.

Role mapping

By default everyone provisioned via SSO becomes an Employee. To auto-map managers and admins, configure attribute-based role mapping in Settings → Security → SSO → Role mapping. Supported attributes are 'role' and 'department' on the SAML assertion.