Connect your IdP - Barndoor Documentation

Overview

This guide demonstrates how to integrate an Identity Provider (IdP) such as Okta or Entra ID with Barndoor to enable:

Barndoor works with any OIDC or SAML 2.0 compatible IdP. If you use Okta or Microsoft Entra ID, follow the dedicated provider guide below for screenshots and provider-specific gotchas. Otherwise, use the generic flow on this page.

Choose your provider

Using a different IdP (Google Workspace, JumpCloud, OneLogin, Ping, etc.)? The generic OIDC/SAML 2.0 flow below applies to all of them.

Video Walkthrough

Self Serve IDP and Role Mapping Demo

Prerequisites:

How it works

At a high level, connecting any IdP follows the same stages:

  1. Configure the connection in Barndoor with your IdP’s Issuer URL, Client ID, and Client Secret.
  2. Verify SSO login works for a standard user.
  3. Configure role mapping so IdP group membership provisions Barndoor admins automatically.
  4. Test offboarding by removing a user from the admin group.
  5. (Optional) Enforce organization-wide SSO and configure a break-glass emergency administrator.
  6. (Optional) Remove the SSO connection when you need to disconnect.

Step 1: Configure IdP Connection in Barndoor

  1. Navigate to Identity Provider Settings

Go here in your Barndoor dashboard.

  1. Complete IdP Setup Form

Auto discover will prefill your Authorization, Token, User Info, JWKS, and Logout URLs. If they are not autodiscovered, enter them manually.

  1. Test the Connection

Click Test Connection to verify that Barndoor can communicate with your IdP. ✅ Expected result: “Connection successful” message

  1. Save Configuration

Click Save to activate the IdP connection.

Step 2: Verify SSO Login Works

  1. Log Out of Barndoor

Sign out of your current Barndoor session.

  1. Attempt Login with Enterprise User

Try logging in with the enterprise test user from Step 1 using a user’s email connected to your IdP. You should now be redirected to your IdP’s login page.

  1. Authenticate via IdP

Complete authentication through your IdP (enter credentials, complete MFA if required).

  1. Verify Access to Barndoor

After successful IdP authentication, you should be logged into Barndoor. ✅ Expected result: User is logged in but has standard user permissions (not admin yet).

SSO is now working! Users can authenticate via your IdP.

Step 3: Configure Role Mapping (Auto-Provision Admins)

Now we’ll set up automatic role assignment based on IdP group membership.

Create Admin Group in IdP

  1. Navigate to Groups in IdP

In your IdP (Okta/Entra ID), go to Directory → Groups.

  1. Create or Select Admin Group

Create a new group called “Barndoor Admins” (or use an existing admin group).

  1. Assign Users to Admin Group

Add the test user to the Barndoor Admins group. 💡 Note: Any user in this group will automatically receive admin permissions in Barndoor.

Send IdP Groups to Barndoor

Barndoor can only map roles and evaluate group-based policies when your IdP sends group names during login. For OIDC connections, include a claim named exactly groups in the ID token or UserInfo response.

Role mappings are synced on login. If the mapped group claim is missing or does not match exactly, the corresponding Barndoor role can be removed the next time the user signs in.

  1. Configure the groups claim

In your IdP application, add a groups claim with:

  1. Use your provider's exact steps

The way you emit the groups claim differs per IdP. Follow the dedicated guide for the precise UI:

  1. Verify the emitted claim

Use your IdP’s token preview, logs, or a fresh test login to confirm the token or UserInfo response contains groups with the exact group name you will configure in Barndoor.

Map IdP Group to Barndoor Admin Role

  1. Open Map groups to roles

On the Identity Provider page, open the Map groups to roles card for your SSO connection.

  1. Configure Admin Group Mapping

Set the group name that defines administrators:

  1. Save Role Mapping

Click Save Role Settings. ✅ Expected result: Role mapping saved successfully

Verify Role Provisioning

  1. Log Out and Back In

Sign out of Barndoor and log back in with the test user.

  1. Verify Admin Access

After logging in, confirm:

Role mapping is working! Users in the IdP admin group automatically receive admin permissions.

Step 4: Test User Offboarding (Remove Admin Access)

  1. Remove User from Admin Group in IdP

In your IdP, go to Directory → Groups → Barndoor Admins. Remove the test user from the Barndoor Admins group.

  1. Log Out and Back In

In Barndoor, sign out and log back in with the test user.

  1. Verify Standard User Access

Confirm that:

Changes to IdP group membership are reflected immediately upon next login to Barndoor.

Roll out SSO enforcement

After your IdP connection is saved and SSO sign-in works, the Roll out SSO enforcement section on the Identity Provider page lets you require SSO for every member of your organization. Until you enforce SSO, users can still sign in with Barndoor passwords in addition to your IdP.

If you don’t see Roll out SSO enforcement controls on the Identity Provider page, organization-wide SSO enforcement may not be enabled for your workspace yet. Contact your Barndoor account team.

Enforcing SSO is irreversible in production. It permanently clears Barndoor passwords for all members, terminates every active session (including yours), and requires all future logins through your IdP—except the dedicated break-glass account described below.

What changes when you enforce SSO

When you confirm enforcement, Barndoor:

After enforcement succeeds, sign out and sign back in through your IdP to continue working as an administrator.

Prerequisites

Both items in Before you can enforce SSO must be complete before Enforce SSO is enabled:

  1. Test SSO sign-in Click Test SSO sign-in. Barndoor opens a pop-up window and runs the full IdP login path—not just a connection preflight. Complete authentication in the pop-up. When the test succeeds, the row is marked complete. You can run the test again anytime to confirm sign-in still works.

If the pop-up is blocked, allow pop-ups for the Barndoor site and run the test again.

  1. Configure break-glass admin email Click Manage on the Break-glass admin email row and set an emergency mailbox your security or platform team can use if your IdP is unavailable.
    • The address must use your organization’s IdP email domain (shown as @your-domain in the dialog)
    • It must not already belong to an existing Barndoor user
    • You cannot use your own administrator email as the break-glass account

Click Save. Barndoor stores the address as the configured break-glass email. The dedicated break-glass user account is created when you enforce SSO.

Enable organization-wide SSO

  1. Review the rollout card When both prerequisites are complete, click Enforce SSO at the bottom of the rollout card.

  2. Acknowledge each consequence In the confirmation dialog, check every acknowledgement:

    • Future logins will be exclusively via IdP SSO
    • All Barndoor passwords will be permanently cleared
    • Only your break-glass email will be able to sign in via password going forward
    • All active sessions—including your current one—will be terminated

The dialog also shows your IdP connection name and redirect URI for a final sanity check.

  1. Confirm enforcement Click Confirm Enforcement. On success, Barndoor shows SSO enforcement is active and prompts you to Sign out and sign in with SSO.

If enforcement succeeds but Barndoor shows a warning that not all member passwords were cleared or sessions could not be terminated, SSO enforcement is still active. Sign out and sign in again with SSO, verify member access, and contact support if the warning persists.

Summary

You’ve successfully configured IdP integration with Barndoor! Here’s what you accomplished: ✅ Connected IdP for SSO/OIDC authentication

✅ Enabled automatic role provisioning based on IdP groups

✅ Tested user onboarding (SSO login and admin access)

✅ Tested user offboarding (removed admin access via IdP)

✅ (Optional) Enforced organization-wide SSO with a break-glass emergency account

Key Benefits

Troubleshooting

SSO Login Redirects but Fails

Common causes:

Solution: Double-check credentials in both Barndoor and your IdP. Re-test the connection and review IdP application logs.

Role Mapping Not Working

Common causes:

Solution: Verify the exact group name in IdP matches Barndoor configuration. Confirm user membership in IdP groups. For OIDC, preview the token or UserInfo response and confirm it includes groups with the expected value, such as Barndoor Admins. Re-save role mapping settings and have the user sign out and back in.

Users Can't Access After IDP Connection

Common causes:

Solution: Verify users are assigned to the Barndoor application in your IdP. Check IdP application status. Test connection from Barndoor settings.