Settings & admin

Set up single sign-on (SSO)

Connect Google Workspace, Okta, Microsoft Entra ID, or another SAML provider.

Single sign-on lets people sign in to Timeglass with their company account. It works with Google Workspace, Okta, Microsoft Entra ID, and any identity provider that supports SAML 2.0.

Start the connection in Timeglass

1. 1
   Open Single Sign-On
   Go to Settings → Security and select Set up SSO under Single Sign-On.
2. 2
   Choose your provider and domain
   Pick your Identity Provider, then enter your Email domain, the part after the @ in company email addresses, such as acme.com.
3. 3
   Create the connection
   Select Set up SSO. Timeglass shows the values your provider needs: a Metadata URL, and under Manual SAML values, the ACS URL and Entity ID. Keep this panel open.

Add Timeglass to your identity provider

Every provider needs the same four things: the ACS URL, the Entity ID, the person’s email as the Name ID, and three attributes with these exact names.

• mail: the person’s email address
• firstName: their first name
• lastName: their last name

Google Workspace

1. 1
   Create a custom SAML app
   In the Google Admin console, go to Apps → Web and mobile apps, select Add app → Add custom SAML app, and name it Timeglass.
2. 2
   Download the IdP metadata
   On the Google Identity Provider details screen, select Download metadata. You’ll upload this file to Timeglass at the end.
3. 3
   Enter the service provider details
   Paste the Timeglass ACS URL into ACS URL and the Entity ID into Entity ID. Set Name ID format to EMAIL and Name ID to Basic Information › Primary email.
4. 4
   Map the attributes
   Map Primary email to mail, First name to firstName, and Last name to lastName, then select Finish.
5. 5
   Turn the app on
   Open User access on the app and turn it on for everyone, or for the groups that use Timeglass.

Okta

1. 1
   Create a SAML app
   In the Okta Admin Console, go to Applications → Applications, select Create App Integration, choose SAML 2.0, and name it Timeglass.
2. 2
   Enter the SAML settings
   Paste the Timeglass ACS URL into Single sign-on URL and the Entity ID into Audience URI (SP Entity ID). Set Name ID format to EmailAddress and Application username to Email.
3. 3
   Add attribute statements
   Add mail as user.email, firstName as user.firstName, and lastName as user.lastName. Then finish creating the app.
4. 4
   Assign people and copy the metadata URL
   On the Assignments tab, assign the people or groups that use Timeglass. On the Sign On tab, copy the Metadata URL.

Microsoft Entra ID

1. 1
   Create an enterprise app
   In the Microsoft Entra admin center, go to Enterprise applications, select New application → Create your own application, name it Timeglass, and choose Integrate any other application you don’t find in the gallery.
2. 2
   Enter the basic SAML configuration
   Open Single sign-on, choose SAML, and edit Basic SAML Configuration. Paste the Timeglass Entity ID into Identifier (Entity ID) and the ACS URL into Reply URL.
3. 3
   Set the claims
   Under Attributes & Claims, set the unique user identifier to user.mail. Add claims named mail (user.mail), firstName (user.givenname), and lastName (user.surname), with the namespace left blank.
4. 4
   Assign people and copy the metadata URL
   Under Users and groups, assign the people or groups that use Timeglass. Then copy the App Federation Metadata Url from SAML Certificates.

Other SAML providers

Choose Other / Custom SAML in Timeglass. If your provider can import a service provider, give it the Timeglass Metadata URL. Otherwise enter the ACS URL and Entity ID, send the email as the Name ID, and add the three attributes above.

Finish in Timeglass

1. 1
   Add your provider’s details
   Back in the Single Sign-On panel, choose a Setup method. Metadata URL works for Okta and Entra ID. Use Upload metadata XML for the Google file. Enter fields manually takes the IdP SSO URL, IdP entity ID, and X.509 certificate.
2. 2
   Activate
   Select Activate SSO. The connection shows Active.
3. 3
   Test it
   In a private browser window, go to the Timeglass sign-in page and enter a company email address. You should go to your identity provider and come back signed in.

What changes for your team

• Anyone with an email at your domain signs in through your identity provider, on the web and in the desktop app. The desktop app opens the browser to sign in.
• People you’ve invited join the workspace the first time they sign in with SSO, using the email address the invite went to.
• Email addresses at other domains, such as contractors, keep signing in with email and password.
• IT can install the desktop app with SSO sign-in. See Deploy the desktop app to your team.