Target audience: Workspace administrators

Overview

This document marks the beginning of a dedicated series of Knowledge Base articles, detailing the integration and deployment of our newly introduced Single Sign-On (SSO) solution, which is based on the SAML 2.0 protocol. For LucidLink customers with an Enterprise contract, this implementation is available as of LucidLink version 3.1, released in April 2025.

Configuration overview

Setting up SSO in LucidLink involves five main steps:

Declare and verify one or several email domain(s)
Configure the SSO integration and set it to Optional
Download the domain key and test SSO login
(Optional) Enforce SSO
(Optional) Configure SCIM provisioning

1. Declare and verify one or several email domain(s)

The first step is to declare and verify one or several organisation email domains:

Click the three-dot menu next to your workspace name and select Domain Management.
Click Add email domain, enter your email domain, and confirm.
Click Verify domain, then Generate code. LucidLink generates a token and the domain enters "pending verification."
Copy the record and add it as a new TXT record in your public-facing DNS. The token is valid for 14 days.
Once the DNS record is in place, LucidLink detects it and switches the domain from "pending verification" to "verified." You should see SSO disabled next to the verified domain.
If you have more than one organisation email domain, repeat this process for each additional domain.

2. Configure the SSO integration and set it to Optional

You can now configure the integration with your identity provider, such as Okta, Microsoft Entra, or Google.

Go to the SSO Integration tab and click Set up SSO.
LucidLink generates two URLs that you'll need to save in your SAML application configuration on the identity provider side.
You'll need to save two additional URLs and one certificate, generated by your identity provider into LucidLink.
As each provider is unique, follow the step-by-step procedure for your identity provider available on our knowledge base (linked below).
Once your configuration is complete, click Save.
Navigate back to Domain Management. For each verified domain, click the three-dot menu and select Download Key. You'll have one key per verified domain — save these to your local machine.
Click SSO settings and choose Optional. Do not select Required yet, doing so before SSO is correctly configured will lock you out of the workspace.

3. Download the domain key and test SSO login

Before enforcing SSO on your workspace, it's worth understanding the domain key. This file adds an extra layer of security, guaranteeing our zero-knowledge model. Anyone from a verified domain will need to upload this file when logging in with SSO.

To test:

Log out of the app using the Logout button in the top-right menu.
When logging back in, you'll see a Login with SSO button. Select it, and you'll be redirected to your identity provider to follow the login flow.
Once logged in, you'll be redirected to LucidLink and prompted to upload the domain key.
Once uploaded, you're logged in. The key is saved into the user's home directory, inside a subfolder named .lucid-keys. As long as the key remains there, the desktop app won't prompt for it again.

Note: IDP-initiated login is not supported at this time.

If you use a mobile device management (MDM) tool, you can distribute this file to the correct location on your users' workstations ahead of time.

4. (Optional) Enforce SSO

If you'd like to require all members from your verified organisation email domain to log in with SSO:

Go to Domain Management and set SSO settings to Required.
Users previously logging in with email and password will be logged out immediately and will only see the Login with SSO button going forward.
On their first SSO login, users may need to merge their account by entering their existing LucidLink password.
This enforcement applies only to the verified domain — other email addresses will continue using email/password login.

To require SSO for all users, including external users:

Go to SSO Integration and enable Enforce SSO for external users.

5. (Optional) Configure SCIM provisioning

If you want to provision users and groups in LucidLink directly from your IdP, LucidLink supports SCIM provisioning.

The SCIM base URL and API key are available in the SSO Integration menu.
Follow the procedure for your specific identity provider (linked below), since each provider's setup differs.
Once enabled, users and groups created via SCIM will be flagged as such in the Members and Group Management sections.

New LucidLink Single Sign-On (SSO) SAML 2.0 Implementation