Configuring SSO for your organization
This guide is for your organization administrator on TheAccessible — someone
with an owner, admin, or manager role for your organization. It covers using
the admin console to connect your identity provider and turn SSO on.
Before you start, your IdP administrator should have their IdP metadata ready (a URL or an XML file).
1. Open the SSO settings
- Sign in at pdf.gevell.com.
- Go to
/tenant-admin/sso.
You'll see your service-provider coordinates at the top (entity ID, metadata URL, ACS URL, login URL). These are the values your IdP administrator registers on their side — you can copy them from here.
2. Import your IdP metadata
- Paste your IdP's metadata XML into the metadata box and choose Parse.
- We extract the IdP entity ID, sign-in URL, and signing certificate automatically and fill in the fields. (Parsing does not save anything yet.)
If you don't have the XML handy, you can enter the entity ID, sign-in URL, and certificate manually.
3. Set your verified email domains
Add every email domain your IdP releases — for example yourschool.edu (and any
secondary domains like yourschool.tmc.edu).
This is your safety control. Only addresses on these domains can be provisioned through your connection. It's what stops anyone outside your organization from being added to your account. You cannot enable SSO without at least one verified domain.
4. Map attributes (optional)
- Email attribute — leave blank if your IdP sends the email as the NameID; otherwise enter the exact attribute name your IdP releases.
- Name attribute — the display-name attribute (recommended).
- Department mapping — optionally map IdP group/affiliation values to your departments so users are foldered automatically. Unmapped values are ignored.
See the IdP setup guide for the exact attribute names per stack.
5. Save, then test before enabling
- Save with SSO disabled first. While disabled, sign-in is blocked, so you can configure safely.
- When you're ready to test, enable SSO and have one user open your login link:
https://api-pdf.theaccessible.org/api/sso/<your-slug>/login?redirect=/dashboard - They should be redirected to your IdP, authenticate, and land signed in.
6. Check the login audit
The settings page shows the last 20 sign-in attempts with their outcome. If a test fails, the reason is listed there. Common ones:
| Reason | Meaning | Fix |
|---|---|---|
email_domain_not_allowed | The released email isn't on a verified domain | Add the real domain shown in the audit row |
jit_disabled | Auto-provisioning is off for an unknown user | Enable provisioning, or pre-create the user |
no_email | The IdP released no email and the NameID isn't an email | Ask your IdP admin to release the email attribute |
| "could not verify your sign-in" | Signature, audience, or timing failure | Re-check the certificate and entity ID |
7. Go live
Once a test sign-in succeeds, leave SSO enabled and share your login link with your team, or point them at pdf.gevell.com/auth/sso/start where they type your organization name. See Signing in with SSO.
Turning SSO off
Disabling SSO from this page takes effect immediately for new sign-ins. Existing sessions continue until they expire — to end them sooner, contact us.