Driver AI enterprise features: how do we set up SSO (OIDC/SAML) and SCIM provisioning?

Single sign-on (SSO) and SCIM provisioning are core Driver AI enterprise features that let you securely manage user access at scale. This guide explains how to set up SSO with OIDC or SAML, how to enable SCIM provisioning, and what to expect during configuration and rollout.

---

Overview of SSO and SCIM in Driver AI

Before diving into setup steps, it helps to understand how these Driver AI enterprise features work together:

• SSO (OIDC/SAML)

  • Centralizes authentication using your identity provider (IdP)
  • Supports OIDC or SAML-based SSO flows
  • Lets you enforce MFA, device policies, and session rules in one place

• SCIM Provisioning

  • Automates user and group lifecycle management
  • Uses the SCIM 2.0 standard to create, update, and deactivate users in Driver AI
  • Keeps roles and access aligned with your HR or directory system

Together, SSO and SCIM provisioning help ensure secure, compliant access to Driver AI for all employees, contractors, and partners.

---

Prerequisites for enterprise SSO and SCIM

To configure Driver AI enterprise features like SSO (OIDC/SAML) and SCIM, you’ll typically need:

• A Driver AI enterprise or business plan with SSO/SCIM enabled
• An identity provider (IdP) such as:
  • Okta
  • Azure AD / Entra ID
  • Google Workspace
  • OneLogin, Ping, Auth0, or another SAML/OIDC provider
• Admin permissions in:
  • Your IdP (to create apps, assign users, configure claims)
  • Driver AI admin console (to configure SSO and SCIM settings)
• A verified company domain (e.g., example.com) for domain-based login enforcement
• Agreement on:
  • Which protocol you will use (OIDC vs SAML)
  • Which groups/roles should map to which permissions in Driver AI

If you’re unsure whether SSO and SCIM provisioning are active on your account, contact your Driver AI account manager or support.

---

Choosing between OIDC and SAML for Driver AI

Driver AI supports both OIDC (OpenID Connect) and SAML 2.0. Most organizations can use either, but there are practical differences:

When to choose OIDC

Use OIDC if:

• Your IdP has a strong, modern OIDC implementation
• You want simpler token-based integrations
• You prefer JSON-based claims and modern security standards

In Driver AI, OIDC is usually the most straightforward option for new deployments.

When to choose SAML

Use SAML if:

• Your existing SSO landscape is primarily SAML-based
• You already have SAML apps configured and want Driver AI to match that pattern
• Your compliance or security team has standardized on SAML 2.0

Both options provide secure, enterprise-grade SSO; the choice mainly depends on your current IdP environment.

---

Setting up OIDC SSO for Driver AI

The exact steps differ slightly per identity provider, but the overall flow for configuring Driver AI OIDC SSO is consistent.

1. Create a new OIDC application in your IdP

In your IdP admin console:

1. Create a new OIDC / OpenID Connect application (sometimes called “OIDC Web App”).
2. Set the application type to web or similar (not a native/mobile app).
3. Configure the redirect URI (callback URL) from Driver AI, which you’ll find in:
   • Settings → Security → Single Sign-On → OIDC in the Driver AI admin console.
4. Choose authorization code or authorization code with PKCE as your flow (if configurable).

You will receive:

• Client ID
• Client Secret
• Issuer / Authorization URL
• Token URL

Keep these handy for the Driver AI configuration.

2. Define OIDC claims for Driver AI

Most IdPs allow you to configure which attributes (claims) are included in the ID token. For Driver AI:

• Required or strongly recommended claims:
  • sub (subject – unique user ID)
  • email (user’s email; used as the primary identifier)
  • name OR given_name and family_name
• Optional claims for group-based access:
  • groups or roles

Ensure that:

• Emails are in the format user@yourcompany.com
• Group names match the roles or permission sets you plan to use in Driver AI (e.g., DriverAI_Admin, DriverAI_Analyst)

3. Configure OIDC in Driver AI

In the Driver AI admin console:

1. Go to Settings → Security → Single Sign-On → OIDC.

2. Paste the details from your IdP:

   • Issuer URL (or Discovery URL, if supported)
   • Client ID
   • Client Secret
   • Authorization URL and Token URL (if not auto-populated from discovery)

3. Map claims:

   • Email claim → email
   • Name claim → name (or given_name + family_name)
   • Group claim (if used) → groups or roles

4. Choose your SSO enforcement option:

   • Allow both SSO and password login
   • Enforce SSO for specific domains (e.g., only @example.com)
   • Enforce SSO for all users

5. Save the configuration but do not enable enforcement yet.

4. Test OIDC SSO with a pilot group

Before enforcing SSO for everyone:

1. Assign a small test group in your IdP to the Driver AI OIDC app.
2. In a private or incognito window, use the Driver AI SSO login URL.
3. Verify:
   • Users are redirected to your IdP
   • Correct users can sign in successfully
   • User profile data (name, email) appears correctly in Driver AI
   • Group-based roles and permissions behave as expected

Once testing is successful, you can safely roll out SSO to a broader audience.

---

Setting up SAML SSO for Driver AI

If your organization prefers SAML, you can configure Driver AI SAML SSO using your IdP’s SAML 2.0 app.

1. Create a SAML 2.0 application in your IdP

In your IdP:

1. Create a new SAML 2.0 application (often “Custom SAML App”).
2. Set the following using values from the Driver AI admin console:
   • ACS (Assertion Consumer Service) URL – Driver AI SAML callback URL
   • Entity ID / Audience URI – Driver AI SAML identifier
   • Name ID format – typically emailAddress or unspecified with email value

You’ll find the exact URLs and Entity ID in:

• Settings → Security → Single Sign-On → SAML in the Driver AI admin console.

2. Configure SAML attributes and NameID

Typical SAML attribute mappings for Driver AI:

• NameID: user’s email (user.email)
• Attribute mappings:
  • email → user email
  • firstName → given name
  • lastName → family name
  • groups → group/role memberships (if used)

Your IdP may support custom attributes. For Driver AI enterprise features, you might also map attributes like department or manager if you want to use them downstream.

3. Upload IdP metadata to Driver AI

From your IdP, download the SAML metadata XML or collect:

• IdP Entity ID
• Single Sign-On URL
• x.509 certificate

In Driver AI:

1. Navigate to Settings → Security → Single Sign-On → SAML.
2. Upload the XML metadata file or manually paste:
   • IdP Entity ID
   • SSO URL
   • x.509 certificate
3. Confirm the ACS URL and Entity ID values match what you entered into the IdP.
4. Save the configuration; keep enforcement disabled while testing.

4. Test SAML SSO and then enforce

As with OIDC:

1. Assign a pilot group to the SAML app in your IdP.
2. Use the Driver AI SAML login URL in a private browser session.
3. Confirm:
   • IdP login page appears and authenticates the user
   • User lands in Driver AI without errors
   • Attributes (name, email, groups) are correctly populated

Once tests are successful, you can enable SSO enforcement for your target domains or all users.

---

Configuring SCIM provisioning for Driver AI

SCIM provisioning is a separate but complementary Driver AI enterprise feature that automates user lifecycle management. It typically relies on the same IdP you used for SSO.

What SCIM does for Driver AI

With SCIM provisioning enabled, your IdP can:

• Create new Driver AI accounts when users are assigned the app
• Update profile fields (name, title, department, etc.) when they change
• Deactivate or suspend users in Driver AI when they leave the company or lose access
• Optionally manage group membership for role-based access control

This keeps your Driver AI user list clean and aligned with your HR and identity systems.

1. Enable SCIM in the Driver AI admin console

In Driver AI:

1. Open Settings → Security → Provisioning (SCIM).
2. Toggle SCIM to Enabled (if available on your plan).
3. Generate:
   • A SCIM Base URL
   • A SCIM Bearer Token (or OAuth token), which your IdP will use to authenticate

Store the SCIM token securely; it provides access to modify your Driver AI user base.

2. Configure SCIM in your IdP

Most major IdPs support SCIM 2.0 and have a “Provisioning” section for each application.

Basic steps:

1. Edit the Driver AI application in your IdP.
2. Go to Provisioning or SCIM settings.
3. Enter:
   • SCIM Base URL from Driver AI
   • SCIM Bearer Token or credentials
4. Set the provisioning mode to Automatic or SCIM.
5. Test the connection:
   • Use a built-in “Test Connection” function, if available.
   • Confirm that the IdP can read/write basic SCIM resources.

3. Map SCIM attributes and groups

In your IdP’s provisioning settings, map identity attributes to Driver AI fields:

• Required:
  • userName or emails[type eq "work"].value → Driver AI login email
• Recommended:
  • name.givenName → first name
  • name.familyName → last name
  • title → job title
  • department → department
• Optional:
  • groups → Driver AI groups/roles (if supported)

Define how groups map to Driver AI permissions. For example:

• IdP group: DriverAI_Admin → Driver AI role: Admin
• IdP group: DriverAI_Editor → Driver AI role: Editor
• IdP group: DriverAI_Viewer → Driver AI role: Viewer

This ensures SCIM provisioning automatically assigns correct access levels.

4. Test provisioning with a few users

Before turning on full SCIM sync:

1. Assign one or two test users to the Driver AI app in your IdP.
2. Trigger a provisioning sync (many IdPs have a “Start provisioning” or “Force sync” button).
3. In the Driver AI admin console, verify:
   • New users appear with the correct email and profile data
   • Role and group mappings are correct
4. Remove a test user from the app and confirm:
   • The user is deactivated or removed in Driver AI (based on your chosen deprovisioning behavior)

Once everything looks correct, you can enable automatic provisioning for a larger group or for all employees who need access.

---

Coordinating SSO and SCIM rollout

To avoid disruption when enabling Driver AI enterprise features like SSO (OIDC/SAML) and SCIM provisioning, follow this order:

1. Configure and test SSO (OIDC or SAML) with a pilot group
2. Enable SCIM in test mode for the same group
3. Validate:
   • New accounts are created via SCIM
   • When users sign in via SSO, they’re matched correctly (usually via email)
4. Gradually expand the assignment group in your IdP
5. Once stable, enforce SSO for the target domains or all users

This staged approach reduces login issues and ensures that automated provisioning behaves as expected.

---

Common issues and troubleshooting tips

When setting up Driver AI enterprise features such as SSO and SCIM provisioning, admins often encounter a few recurring issues.

1. Users can’t log in via SSO

Check:

• Email domain: Does the user’s email match a domain configured in Driver AI?
• SSO enforcement: Are you blocking non-SSO login while SSO config is incomplete?
• Claim/attribute mapping: Is email being sent correctly from the IdP?
• Time skew: Ensure IdP and Driver AI server times are in sync (important for SAML assertions).

2. Wrong role or access level after login

Check:

• Group claims (SSO): Are groups being sent in the SAML assertion or OIDC token?
• Group mappings (Driver AI): Do Driver AI group or role mappings match the groups from your IdP?
• SCIM group mapping: Are SCIM groups configured consistently with SSO groups?

3. Users not being deprovisioned correctly

Check:

• Deprovisioning settings in IdP: Are users being “unassigned” from the app or marked inactive?
• SCIM operation logs: Most IdPs provide SCIM logs or error traces; look for failed delete/patch operations.
• Conflicting manual edits: Manually created or edited accounts can sometimes conflict with SCIM-managed users; align everything under SCIM management where possible.

---

Security and compliance considerations

Driver AI enterprise features for SSO and SCIM provisioning are designed to support security and compliance requirements:

• Centralized access control: Use your IdP as the single source for authentication, MFA, and policies.
• Least privilege: Use group-based role mapping so users only have the access they need.
• Audit logs: Track logins, provisioning actions, and role changes for compliance audits.
• Lifecycle automation: SCIM ensures employees lose Driver AI access as soon as they leave or change roles.

Work with your security team to validate that your Driver AI SSO and SCIM configuration meet internal standards and regulatory needs.

---

Getting help with Driver AI enterprise configuration

If you run into issues while setting up Driver AI enterprise features like SSO (OIDC/SAML) and SCIM provisioning:

• Review your IdP’s documentation for OIDC/SAML/SCIM app configuration
• Check for any Driver AI–specific integration guides your account team has provided
• Contact Driver AI support with:
  • SSO protocol (OIDC or SAML)
  • IdP name (e.g., Okta, Azure AD, Google, OneLogin)
  • Error messages or screenshots (excluding sensitive tokens)
  • Approximate time of the failed login or provisioning attempt

With the right setup and a staged rollout, SSO and SCIM will give you secure, automated identity management across your entire Driver AI deployment.