Primary navigation

Identity and access

Deployment and configuration

Plugins and connections

Try ZeroTwo

Identity and access

Verify domains, configure SAML single sign-on, and provision users with SCIM for a ZeroTwo Business workspace

The Identity & access page of the admin console brings together the settings that tie a Business workspace to your organization's domains and identity provider. Open it at /admin/identity. Its Identity & provisioning tab has five cards: Verified Domains, Organization identity, Identity Management, User Provisioning and Directory Sync (SCIM).

Verify a domain

Several identity features need at least one verified domain.

  1. Add the domain

    In Verified Domains, choose Add domain and enter it, for example example.com. Free email domains cannot be added.

  2. Publish the TXT record

    The dialog shows a record to add at your DNS provider: a TXT record on _zerotwo-verification.<your domain> whose value starts with zerotwo-domain-verification=.

  3. Verify

    Once the record is live, choose verify. The domain's status changes from Pending verification to Verified.

A domain can be verified by only one workspace. Remove one with Delete domain.

Set the organization slug

Organization identity sets the Organization slug, chosen from your verified domains. Saving it is permanent: the slug cannot be changed afterwards.

Configure SAML single sign-on

Identity Management sets up SAML. Paste your identity provider's Metadata URL (it must use https) or its Metadata XML. After you save, the card shows the ACS URL and Entity ID to enter in your identity provider. Then turn on Enable single sign-on, choose Enforcement (Optional or Required), and use Update metadata when the provider's certificate or settings change. A badge shows whether SSO is Active, Pending setup or Disabled. OIDC is not offered.

The SAML connection can be configured, but the ZeroTwo sign-in screen does not offer single sign-on yet and the Required setting is not enforced. Members keep signing in with their usual method.

Provision users

User Provisioning has three switches. Automatic Account Creation and Allow External Domain Invites need a verified domain before they can be turned on; Enable workspace discovery is the third.

Sync your directory with SCIM

Directory Sync (SCIM) shows the SCIM base URL and a table of tokens with their creation date, last use and status. Choose Generate token and give the URL and token to your identity provider. ZeroTwo supports SCIM 2.0 users and groups, so people and groups created, updated or removed in your directory are mirrored in the workspace, and synced groups appear read-only under Groups. Only workspace owners can generate or revoke SCIM tokens.