Single Sign-On (SSO)

SSO Setup and Usage

---

Danger

This guide is intended for system administrators. If you lack the necessary technical expertise, please contact your IT department for assistance.

The Prevu3D Cloud Platform supports secure Single Sign-On (SSO) via industry-standard protocols:

• SAML 2.0 – for authentication and user sign-in.

• SCIM 2.0 – for automatic user and group provisioning.

Supported Identity Providers

Any identity provider that fully supports the SAML 2.0 and/or SCIM 2.0 protocols should be compatible with Prevu3D, including Okta, Google Workspace, OneLogin, Ping Identity, and others. Prevu3D’s implementation follows the official SAML 2.0 and SCIM 2.0 specifications, ensuring broad compatibility with modern identity systems.

We have thoroughly tested integration with:

• Microsoft Entra ID (formerly Azure Active Directory)

• JumpCloud (English)

Note

• Each Prevu3D organization supports only one connection to one identity provider at a time.

• The SSO feature is included in the Enterprise subscription. Contact sales@prevu3d.com to enable it for your organization.

SAML 2.0 – Authentication Setup

Prerequisites

To configure SAML-based SSO with Prevu3D, you will need:

• Admin access to your Prevu3D organization.

• Access to your IdP with permission to configure applications.

Steps

1. Sign in to your Prevu3D account (using your email address and password)

2. Go to the Settings tab

3. Select the SSO tab from the menu on the left

Can’t access the “SSO” tab?

1. If it’s missing, you are not an organization administrator.

2. If it’s grayed out, your organization has not subscribed to the SSO feature.

4. Copy the following values from the SSO tab and paste them into your IdP configuration:

   • Service Provider Endpoint – the URL your IdP posts the SAML assertion to. Your IdP may call this the ACS URL, Reply URL, or Assertion Consumer Service URL.

   • Service Provider Entity ID – the unique identifier for Prevu3D in the SAML exchange. Your IdP may call this the Audience, Identifier, or SP Entity ID.

Caution

Enter the Entity ID in your IdP exactly as shown on the SSO tab, including the full suffix (for example xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx-production-############-Prevu3DCloudPlatform). Copy and paste it rather than retyping it.

If your IdP sends a shortened or friendly-name audience value (for example Prevu3D), authentication is rejected with an audience mismatch even though the rest of your configuration is correct. This is the most common setup error — see Troubleshooting.

5. Retrieve the following from your IdP and enter them on the SSO tab:

   • SAML Certificate (PEM format)

   • SAML Endpoint URL

6. If SCIM is not enabled, define the SAML attribute mappings – see SAML attribute mappings below.

   

Caution

These attributes are optional when SCIM provisioning is enabled and configured. SCIM automatically manages user details.

7. Click Save at the bottom of the page.

8. Verify the configuration before rolling it out – see Validating your configuration below.

SAML attribute mappings

Each field tells Prevu3D which attribute (claim) to read from the SAML assertion sent by your identity provider. The value you enter must match the attribute name configured in your IdP exactly, including capitalization.

Field	What to enter	Example values
First Name SAML Attribute Key	The name of the IdP attribute containing the user’s given name	givenName, firstName, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Last Name SAML Attribute Key	The name of the IdP attribute containing the user’s surname	familyName, surname, lastName
Role SAML Attribute Key (optional)	The name of the IdP attribute containing the Prevu3D role to assign. Required only if you want to manage Prevu3D roles from your IdP – see Role Mapping	Prevu3DRole
Default Organization Role	The role assigned when no role attribute is provided, the attribute is empty, or role mapping is not configured – see Role Mapping	Guest (recommended)

Not sure which attribute names your IdP sends? Capture a SAML trace using a browser extension such as SAML-tracer and check the names listed in the AttributeStatement, or consult your IdP’s application configuration.

Rolling out SSO to your users

Once the configuration is saved and validated, two things determine whether your users can actually sign in.

Domain configuration and new users

Your email domain must be associated with your Prevu3D organization. Domain configuration enables:

• Login page redirection – users who click Sign in with SSO and enter an email on your domain are redirected to your IdP.

• Just-in-time account creation – when a user on your domain who has never used Prevu3D authenticates successfully through your IdP, a Prevu3D account is created automatically, with names populated from your SAML attribute mappings and the Default Organization Role applied. No invitation or manual account creation is required.

Note

Domain configuration is completed by Prevu3D as part of your Enterprise SSO onboarding. Contact support@prevu3d.com to claim your email domain(s).

Until the domain is configured, users on your domain are not redirected to your IdP and may receive an invalid_user_email_domain error when authenticating.

Caution

Users created through SSO receive the Default Organization Role and no project access by default. Grant project access through Groups (with Group Mapping) or by adding users to projects directly.

Users on an SSO-configured domain should sign in with SSO rather than creating a password-based account from an email invitation link.

Existing users and account linking

Accounts created before SSO was enabled must be linked to your identity provider once before they can be used with SSO. Users are guided through this the first time they sign in with SSO, and their projects and data are preserved. The steps they see are documented in Sign up & Log In.

Caution

Linking requires each user’s existing Prevu3D password, so anyone who has forgotten theirs must reset it before they can link.

To avoid this entirely, contact support@prevu3d.com to link all accounts on your email domain in a single operation. Users then never see the linking flow.

Validating your configuration

Before rolling SSO out broadly, test with a small group of users and confirm:

• Sign-in succeeds from both the Prevu3D login page (Sign in with SSO) and your IdP dashboard.

• First and last names are populated correctly on new accounts.

• The expected organization role is assigned when the role attribute is present.

• Users without a mapped role receive the intended default role.

• No users receive broader permissions than expected.

• Group memberships are applied as intended, if you are using Group Mapping.

Note

A SAML trace captured with a browser extension such as SAML-tracer is the fastest way to verify exactly which attributes and audience value your IdP is sending.

Role Mapping (optional)

You can assign Prevu3D organization-level roles via a custom SAML attribute (e.g., Prevu3DRole):

• Admin – Full permissions across the company

• Guest – No default access (must be granted at the project level)

If no role attribute is provided, a default role is applied. For security reasons, we recommend setting this to Guest.

Caution

If SCIM is enabled, role assignment should instead be handled via SCIM.

Group Mapping (optional)

It is also possible to map groups from your IdP system to Prevu3D groups to simplify access management for people in your organization. The following steps guide you through mapping your groups.

• Configure your IdP to pass group memberships via a SAML attribute.

• Enter this attribute on the SSO tab.

• In the “Groups” section of Prevu3D, click “Edit group” and specify the SAML group value expected by your IdP.

• This mapping is applied to users when they sign in to Prevu3D Cloud. If the user is already signed in, they should sign out and sign back in for access changes to take effect.

Note

• Group mapping is applied at sign-in. Users must sign out and sign back in to apply the updated access.

• Ensure that the group is granted some access; for more information, see the groups section.

Caution

• If SCIM is enabled, group creation and membership assignment should instead be handled via SCIM.

SCIM 2.0 – Provisioning Setup

Prevu3D supports user and group provisioning via the SCIM 2.0 protocol (System for Cross-Domain Identity Management).

Prerequisites

• Your organization must be on the Enterprise plan.

• Your IdP must support SCIM (e.g., Azure AD/Entra, Okta, JumpCloud).

What SCIM enables

• User provisioning – New users are automatically created in Prevu3D

• User deprovisioning – Users are disabled or removed when they are disabled in your IdP

• Group assignment – Groups and roles can be centrally managed from your IdP

Setup Guide

1. Sign in to your Prevu3D account as an organization administrator.

2. Go to the Settings tab

3. Select the SSO tab from the menu on the left

4. Scroll to the SCIM Provisioning section and enable it.

   

5. You will find:

   • SCIM Base URL (Entra ID users, please see the warning below)

   • Bearer Token

Note

You can also rotate the bearer token when required for security or credential rotation.

Caution

When configuring SCIM with Entra ID (Azure AD), you must append ?aadOptscim062020 to the end of the SCIM Base URL provided by Prevu3D.

6. In your identity provider (e.g., Microsoft Entra ID):

   • Open the Prevu3D enterprise application.

   • Enable SCIM provisioning.

   • Enter the SCIM Base URL and Bearer Token obtained from the SSO tab.

7. Configure attribute mappings for:

   • userName, givenName, familyName, email

   • Optional: groups, roles, active

8. Save your configuration

   Your IdP will now automatically sync users and groups with Prevu3D based on the provisioning schedule.

Troubleshooting

Symptom	Likely cause	What to do
Sign-in does not complete after the IdP redirects back to Prevu3D	The audience value in the SAML assertion does not exactly match the Service Provider Entity ID. Your IdP may be sending a shortened or friendly-name value.	In your IdP, set the Audience / Identifier / Entity ID field to the exact value shown on the SSO tab, including the full suffix.
User enters their email and password on the login page and is never sent to the IdP	The main login form is for password-based accounts only.	Have the user click Sign in with SSO below the Login button, then enter their work email.
No redirect after entering a work email on the Sign in with SSO screen	The email domain is not associated with your Prevu3D organization.	Contact support@prevu3d.com to configure your email domain.
{"statusCode":401,"message":"invalid_user_email_domain"} after authenticating at the IdP	Same cause: the user’s email domain is not associated with your organization.	Contact support@prevu3d.com to configure your email domain.
User sees “session timed out” and is asked to re-enter their email	Normal part of the one-time account linking flow for accounts created before SSO was enabled.	Have the user continue; this is not an error. See Existing users and account linking.
An existing user cannot complete account linking	Linking requires the user’s existing Prevu3D password, which they may not remember.	Have them reset it with Forgot password, or request bulk linking for your domain from support@prevu3d.com.
Names are blank or wrong on new accounts	The SAML Attribute Keys entered on the SSO tab do not match the attribute names your IdP sends. These values are case-sensitive.	Capture a SAML trace, check the attribute names in the AttributeStatement, and update the mappings to match exactly.
A user was assigned an unexpected role	No role attribute was sent, so the Default Organization Role was applied, or the role attribute value does not match a Prevu3D role.	Verify the Role SAML Attribute Key and the values your IdP sends, then review your Default Organization Role setting.
Group access changes are not taking effect	Group mapping is applied at sign-in only.	Have the user sign out and sign back in.
Opening the Service Provider Endpoint URL directly in a browser returns {"statusCode":500,"message":"Internal server error"}	Expected. This endpoint only accepts SAML POST requests and cannot be opened directly in a browser.	This does not indicate a configuration problem. Test by signing in from the login page or your IdP instead.

Note

If you are still stuck, capture a SAML trace of an unsuccessful sign-in attempt, redact any sensitive values, and send it to support@prevu3d.com. Include the audience value and the attribute names shown in the assertion — this lets our team diagnose most issues in a single pass.

Definitions

• IdP, Identity Provider: refers to the system that registers all users and enables connection to various other services. This is your source of truth for your organization, users, and groups. E.g.: Azure AD, JumpCloud…

• SP, Service Provider: refers to the service application that consumes SSO information, in this case Prevu3D Cloud.

• SSO, Single Sign-On: refers to a mechanism that allows users to obtain their credentials from a single portal and distribute user management configuration across multiple applications.

• SAML, Security Assertion Markup Language: an industry-wide protocol that enables the use of SSO across multiple cloud-based platforms.

• SCIM, System for Cross-Domain Identity Management: protocol for provisioning users and groups.