Caddi supports SAML 2.0 single sign-on with any compliant identity provider. Setup is done with the Caddi team rather than in the app.
How the setup process works
Ask Caddi to start the setup. We send you the connection details — the URLs and identifiers — to use in your identity provider.
Configure your identity provider with those details and the required SAML attributes.
Send your IdP metadata back to us so we can complete the connection on our side.
Test the login flow with a pilot user before rolling out to the whole firm.
Typical end-to-end timeline is 1 to 3 business days once both sides have what they need.
Before you begin
SAML SSO is available on some Caddi plans. If you are not sure whether your contract includes it, check with your Caddi account team before you start.
You will also need:
Admin access to your identity provider (for example, Okta Super Admin, or Entra ID Application Administrator)
The list of email domains your users will sign in with (for example,
acme.com,acme.co.uk)
Step 1: Ask Caddi to start the setup
Either route works:
In Caddi, open Settings > Organization, find the Single sign-on (SAML) card and select Request setup. That opens a conversation with our team with your organization details already filled in.
Or email support@trycaddi.com with the subject line "SSO Setup Request".
Either way, include:
Your firm name and Caddi organization name
The identity provider you will be using
The email domain or domains your users will sign in with
The name and email of the primary technical contact for setup
We will reply with two values you need in Step 2:
ACS URL (also called the "Single Sign-On URL")
Entity ID (also called the "Audience URI" or "SP Entity ID")
Step 2: Configure your identity provider
Required SAML settings (all identity providers)
Whichever provider you use, the SAML application must be configured with the following:
Setting | Value |
Single Sign-On URL / ACS URL | Provided by Caddi |
Entity ID / Audience URI / SP Entity ID | Provided by Caddi |
NameID format |
|
NameID value | The user's email address |
Protocol binding | HTTP-POST |
Required SAML attributes
The SAML assertion sent to Caddi must include the following attributes. The attribute names must use these exact URIs:
Attribute name (URI) | Maps to | Required |
| User email | Yes |
| First name | Yes |
| Last name | Yes |
If your identity provider cannot send these exact attribute names, tell us what it does send and we will adjust the connection mappings on our side to match.
Okta
The steps below were checked against Okta Identity Engine in May 2026.
In the Okta Admin Console, go to Applications > Applications and select Create App Integration.
Select SAML 2.0 and select Next.
On the General Settings screen, enter an App name (for example, "Caddi") and select Next.
On the Configure SAML screen, enter:
Single sign-on URL: the ACS URL from Caddi
Audience URI (SP Entity ID): the Entity ID from Caddi
Name ID format:
EmailAddressApplication username:
EmailUpdate application username on:
Create and update
Scroll down to Attribute Statements and add the following three attributes:
Name | Name format | Value |
| URI Reference |
|
| URI Reference |
|
| URI Reference |
|
If you see "Invalid property" errors, your tenant may be running the older Okta Classic Engine. In that case use user.email, user.firstName and user.lastName instead. Most modern tenants run Identity Engine.
6. Leave all other SAML settings at Okta's defaults. For reference, these are the values we have tested with:
Setting | Value |
Default Relay State | (empty) |
Response | Signed |
Assertion Signature | Signed |
Signature Algorithm | RSA_SHA256 |
Digest Algorithm | SHA256 |
Assertion Encryption | Unencrypted |
SAML Single Logout | Disabled |
SAML Signed Request | Disabled |
authnContextClassRef | PasswordProtectedTransport |
Honor Force Authentication | Yes |
7. Select Next, complete the feedback screen, and select Finish.
8. Go to the Assignments tab and assign the users or groups who should have access to Caddi.
9. Go to the Sign On tab. Under SAML Signing Certificates, find the Identity Provider metadata link. Right-click it and choose Save Link As to download the metadata XML file. You will send us that file in Step 3.
Other identity providers
Caddi works with any SAML 2.0 identity provider. For a provider other than Okta, your IT team should configure a custom SAML application using the values in Required SAML settings and Required SAML attributes above.
If you run into trouble configuring a non-Okta provider, contact us and include:
The identity provider you are using
A copy of the SAML response (most providers offer a "SAML Tracer" extension or a test login that captures this)
Your SAML configuration and related settings
Any error message shown during login
We will work with you to adjust the connection on our side.
Step 3: Send your configuration to Caddi
Reply to your support thread with:
The IdP metadata XML file from Step 2 (Okta: step 9), or
The following values pulled from your identity provider:
Sign-In URL (the IdP SSO endpoint)
X.509 Signing Certificate
Issuer (the IdP Entity ID)
Metadata XML is preferred, since it contains everything we need in one file.
We then finish provisioning the connection on our side. This typically takes a few hours during business days.
Step 4: Test the login flow
Once we confirm the connection is live:
Go to the Caddi login page.
Enter the email address of a user you assigned to the SAML app in Step 2.
You should be redirected to your identity provider. Complete the login there.
You will be returned to Caddi and signed in.
What changes once SSO is live
Invitations close. Once an SSO connection is linked to your organization, Caddi stops accepting member invitations entirely — the invite control is replaced with a note reading "People join by signing in with SSO. Your IT admin assigns Caddi to them in your identity provider," and any invitation sent another way is refused. From that point on, the way to give someone Caddi is to assign them the Caddi application in your identity provider. Make sure whoever manages that assignment is ready before you ask us to link the connection.
New users. When someone signs in through SSO for the first time, a Caddi account is created for them automatically and they join your organization as a member.
Existing Caddi users. If someone already has a Caddi account — for example, they were invited before SSO was enabled — their account is linked to their SSO identity on their first SSO login, as long as the email address matches. They keep their history and permissions.
Password login. By default, people in your organization can still sign in with their existing password as an alternative to SSO. If you want SSO to be the only way in, ask us to turn on Require SSO for your organization.
Troubleshooting
The Settings page still says "Not connected" The Single sign-on (SAML) card on Settings > Organization does not reflect connection status. Confirm your setup by signing in through your identity provider as in Step 4, which is the real test.
"Your organization is not yet configured with Caddi" Caddi received the login but could not match it to your organization. Contact us and we will verify the connection on our side.
Login completes but Caddi shows an error about a missing email The SAML assertion did not include an email attribute. Confirm the Attribute Statements in Step 2 are configured exactly as shown, including the full URI as the Name — not a friendly name like "email".
Login redirect loops, or returns to your identity provider without signing in Usually a NameID mismatch. Confirm that Name ID format is set to EmailAddress, not Unspecified, and that the NameID value is the user's email address.
Anything else Email support@trycaddi.com with the affected user's email address, the approximate time of the login attempt, and any error message shown. We can pull the matching logs to diagnose.