Single Sign-on (SSO) Support FAQ

Rewind supports single sign-on (SSO) for improved access control and security for your Rewind account. Rewind uses Security Assertion Markup Language (SAML), which is an SSO login method offering more secure authentication (with a better user experience) than usernames and passwords. Rewind will support SAML-based identity providers (IdPs) such as Okta, OneLogin, Auth0, and more. Please check your identity providers’ websites to see if they support SAML .

Single Sign-on FAQ

Which version of SAML does Rewind support?

Rewind supports SAML 2.0.

Do you support automatic user provisioning?

Rewind supports “just in time” user provisioning. New users who authenticate using your IdP are automatically created in Rewind and added to your organization with the role your IdP sends for them.

What permissions do SSO users have?

Each SSO user's access is set by the rewind_role value your IdP sends when they sign in. A role can give full admin access to your organization, or admin or read-only access to one platform or one specific account. See How to set up SAML single sign-on (SSO) for app.rewind.com for the role format and supported platform values, and User roles and permissions in Rewind (RBAC) for what each access level allows.

Can I assign Rewind roles using groups in my identity provider?

Yes. Instead of setting a rewind_role value on each user, you can let group membership decide each user's role. Rewind only reads the rewind_role value your identity provider sends, so it works the same with any provider that can send a value based on groups. Use the role attribute name your SSO was configured with; the default is rewind_role.

Microsoft Entra ID

1. In App registrations, open the Rewind application and go to App roles. Create one app role per Rewind role. Set Allowed member types to Users/Groups and Value to the exact role, such as organization:admin or platform:jira:read_only.
2. In Enterprise applications, open the Rewind application, go to Users and groups and assign each group to its app role.
3. Under Single sign-on, Attributes & Claims, set the rewind_role claim's source attribute to user.assignedroles and leave its Namespace empty.

Users must be direct members of the assigned group. Entra doesn't pass app roles through nested groups.

Okta

1. Create one group per role and name it exactly after the role value, such as organization:admin or platform:jira:read_only.
2. Assign those groups to your Rewind SAML application. Only users assigned to the application, directly or through a group, can sign in.
3. In the application's SAML settings, add a group attribute statement named rewind_role with the filter Matches regex (organization|platform|account):.*, so only your role groups are sent.

What happens if a user is in more than one role group?

They can sign in, and Rewind combines their roles. If one of them is organization:admin, the user gets full admin access and may see a one-time notice about conflicting access levels. Otherwise, if the roles mix admin and read-only access, Rewind applies read-only access.

When do role changes take effect?

The next time the user signs in to Rewind. Ask users to sign out and back in after you change their groups.

I removed a user from all role groups, but they still have access. Why?

Rewind keeps a user's last role until a new value arrives. To remove someone's access, unassign them from the Rewind application in your identity provider.

Can SSO users reset their password?

No, SSO users will be redirected to the SSO login page: https://app.rewind.com/users/sign_in (click on Sign in with SSO instead) when attempting to reset their password. This is based on the email domain.

What if the user already exists in Rewind?

The first time the user logs in with SSO, the system will detect that they already have an email/password set up, and they will be asked to confirm their password on that account to complete the link. When they log in with SSO in the future, they won't be prompted for their password again.

Once the user logs in with SSO, they cannot reset their password through the normal process and will be redirected to log in with SSO instead.

Do you support automatic user provisioning or de-provisioning?

No, we currently do not support SCIM (System for Cross-domain Identity Management). Access needs to be controlled within your IdP.

Can I still invite users using the traditional invite mechanism?

No, once an organization is set up with SSO, the user management needs to be done within your IdP.