Agent WranglersBusiness sign-on and provisioning
Let each business customer bring its own identity provider, add and remove users through SCIM, and act on the security signals it sends.
- Required 1
- Recommended 4
- Optional 1
Required
Remove access at once when the directory says so
RequiredWhen a customer's directory deactivates or deletes a user, end that user's sessions and tokens in the organisation within 1 minute, and keep their work.
Recommended
Connect single sign-on per organisation
RecommendedLet each business organisation connect its own identity provider through SAML 2.0 or OpenID Connect, and route its users there by verified email domain.
Let organisations require single sign-on
RecommendedLet an organisation require its single sign-on for every member with its domain. Keep one owner with a passkey who can sign in without it.
Provision users with SCIM
RecommendedOffer SCIM 2.0, as RFC 7643 and RFC 7644 define it, so a customer's directory creates, updates and removes users and groups.
Map directory groups to roles
RecommendedLet organisation admins map their directory groups to your roles, and apply the mapping on every SCIM change and every sign-in.
Optional
Listen for security signals from the customer's provider
OptionalReceive OpenID Shared Signals events from customers' identity providers, and end sessions when they report a revoked session or a disabled account.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning.