SSO - OpenID Connect & SCIM

To leverage OIDC, you first need to create an Organization in All Quiet.

Begin by reaching out to our support team at support@allquiet.app. Provide details about your organization and the identity provider you are using. Our team will assist you with the initial setup process and provide necessary guidance.

In your identity provider’s management console, you will need to register All Quiet as a new application.

For the integration, you will need to provide the Client ID, Client Secret, and the Authority URL from your IdP. The Authority URL is usually the client-specific domain derived from the discovery document URL. These details are essential for establishing a secure and reliable connection between your IdP and All Quiet.

Additionally, you’ll need to configure the Redirect URI in your IdP to https://allquiet.app/signin-oidc.

It’s important to share Client ID, Client Secret, and the Authority URL over a secure channel with us to protect your sensitive information. One recommended way is through services like Yopass. All Quiet stores all secrets strongly encrypted in our database to ensure the safety of your credentials.

Once the setup is completed, our team at All Quiet will perform a series of tests to verify the integration. This ensures that authentication requests are properly handled and user identities are correctly established through your IdP.

After successful verification, the integration is considered complete. Your users can now sign in to All Quiet using their existing organizational credentials managed by your IdP.

To leverage SCIM, you first need to create an Organization in All Quiet. The account that creates the Organization cannot be provisioned via SCIM. Therefore, we recommend to create the Organization with a root user that is not bound to a specific employee, like admin@allquiet.app. This way, you ensure all “real” on-call users and employee accounts can be provisioned. If you already set up the Org with your personal account, you can change your account’s email address via the Web app on /app/account to a root user email and later provision your personal email and account via SCIM.

Begin by reaching out to our support team at support@allquiet.app. Provide details about your All Quiet Organization and the SCIM provider you are using. Our team will assist you with the initial setup process and provide necessary guidance.

In your SCIM provider’s console, you will need to register All Quiet as a new SSO application.

For the integration, you will need to provide the Base URL and API Key of your All Quiet Organization.

After getting in touch with our team, we will create your Organization’s Base URL. It will be visible under

1. Organizations.
2. Select your Organization and the tab SSO.

Additionally, you’ll need an API Key. To find or create your Organization’s API Key, open

1. Organizations.
2. Select your Organization and the tab API Keys.
3. Retrieve your API Key
4. Alternatively, click Create API Key if you haven’t created one yet.

Both, Base URL and API Key will be necessary to activate All Quiet as a new SSO application of your SCIM provider and to establish a secure and reliable connection. All Quiet stores all secrets strongly encrypted in our database to ensure the safety of your credentials.

Make sure to select the Users and User Groups you want to share with All Quiet in your SCIM provider’s interface.

Once the setup is completed, you will find the users provisioned via SCIM under

1. Organizations
2. Tab User Provisioning.

You can use the User Groups from your SCIM provider for Team management in All Quiet. This is a convenient and much leaner alternative to manual team invites for larger organizations.

Go to Organizations > Tab SSO

1. Choose whether provisioned users should be assigned Member or Administrator roles within the teams. You can update these roles via the Teams section at any time for each User. Learn more about team roles here.

Manual Provisioning Mode

2. Choose your Provisioning Mode. In the first example, we choose Manual Provisioning (see “Auto Provisioning from Groups”, below). We recommend this method if you want to be flexible and want to be able to switch SCIM User Groups between All Quiet Teams.

   Switching the Provisioning Mode between Manual and Auto will remove all previously provisioned users from their teams, as this action resets the existing mappings. To avoid disruptions, we recommend choosing a provisioning mode and sticking with it.

3. Map your SCIM User Groups to your Teams in All Quiet. For Manual Provisioning Mode, there have to be existing teams for you to be able to map them.

   Changing an existing mapping will add Users to other All Quiet Teams and / or remove them from their old Teams, depending on your selection. If you use the Teams section to invite Users from your SCIM Groups to your All Quiet Teams, those users will remain in the Team, even if you later remove their SCIM Group from the Team.

4. Save your settings. You will find the Users from your SCIM User Groups in your All Quiet Teams.

Auto Provisioning from Groups

1. In this case, we’ve selected Auto Provisioning from Groups as provisioning mode. For this mode you don’t have to create All Quiet teams in advance. However, it’s also much stiffer.
2. You can use this field if you only want certain user groups to be auto provisioned to teams.
3. A preview showing which SCIM User Groups will create which All Quiet teams.
4. Again, safe to create the teams through auto provisioning mode.