SSO
Configure single sign-on and directory sync for your organization through the Admin Portal.
Organization SSO (Single Sign-On) lets the members of a collaborative organization sign in through your identity provider. Directory sync (SCIM) keeps the organization's members in sync with your directory.
You configure both in the Admin Portal, a hosted setup page that Daytona opens through a short-lived setup link. Each identity provider you connect there appears in Daytona as an SSO connection, with its status and the email domains it signs in. When the organization is shared with Daytona v0, its single sign-on and directory sync configuration is shared with Daytona v0 too.
Managing SSO requires the SSO permissions. Members with the admin or sso-admin role hold them. See roles.
| Field | Description |
|---|---|
| Name | The connection name. |
| Connection type | The connection protocol and provider type. |
| Status | The connection status. |
| Email domains | The email domains the connection signs in. |
| Updated at | When the connection was last updated. |
Configure SSO and directory sync
Daytona provides methods to open the Admin Portal for single sign-on or for directory sync. The setup link expires five minutes after it is created, so open it right away. When you finish in the Admin Portal, it returns you to the SSO page of the dashboard.
- Go to Daytona SSO ↗
- Click Configure SSO to connect your identity provider, or Configure Directory Sync (SCIM) to connect your directory
- Complete the setup in the Admin Portal
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/sso/setup-links' \
--request POST \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
--data '{ "intent": "sso" }'| Field | Type | Description |
|---|---|---|
intent | string | Sets the setup area to open: sso for single sign-on or dsync for directory sync. This field is required. |
The response has the following fields:
| Field | Description |
|---|---|
url | The Admin Portal setup link. It expires five minutes after it is created. |
List SSO connections
List the SSO connections configured for the organization in the Admin Portal. An organization that has not completed the setup has no connections.
- Go to Daytona SSO ↗
- The connections table shows each connection with its status, email domains, and last update
curl 'https://api.daytona.com/orgs/ORGANIZATION_ID/sso/connections?limit=100' \
--header 'Authorization: Bearer YOUR_OIDC_TOKEN'| Parameter | Type | Description |
|---|---|---|
limit | integer | Sets the page size, from 1 to 200. The default is 100. |
cursor | string | Resumes the list after the previous page. Pass the next_cursor of that page. |
The response has the following fields:
| Field | Description |
|---|---|
connections | Lists the SSO connections, each with id, name, connection_type, status, the email domains it signs in, created_at, and updated_at. |
next_cursor | The cursor of the next page, or null on the last page. |
Permissions
SSO requests require a signed-in user token and do not accept API keys. SSO configuration is governed by two organization permissions, which you can grant through an organization role:
| Permission | Grants |
|---|---|
read:sso | List SSO connections |
write:sso | Create SSO and directory sync setup links |