Product · Hand off setup and watch it
Customer Admin Portal
Your customer’s IT admin sets up SAML from an invite link
You create an invite link in the dashboard, or through the API with a dashboard session. It works once and lasts 30 minutes. Your customer’s IT admin uses it to set up SAML or turn on SCIM. The IT admin needs no password and gets no access to your dashboard. The Admin Portal has no metadata upload, no connection test and no working OIDC tab.
Access
One invite link opens one session for one account.
Invite link
An invite link works once and expires after 30 minutes. It is a bearer credential: whoever opens it first gets the session. RealmSSO stores only its SHA-256 hash. You create the link in the dashboard, or through the API with a dashboard session. An API key cannot create one.
Session length
The whole session ends 30 minutes after RealmSSO made the link. The IT admin cannot change this. A late opener needs a new link.
No account needed
The IT admin needs no password and no account of their own. The session reaches one account only and gives no access to your dashboard.
What the IT admin can do
The portal screens cover SAML and SCIM. The OIDC tab does not work today, so you set up OIDC in the dashboard or the API.
Set up SAML
The IT admin sets up SAML from a metadata URL or from three manual values. The values are the IdP’s entity ID, SSO URL and certificate. Saving updates the existing connection. The portal view covers one SAML connection and has no metadata upload.
Values to register
After the first save, the Admin Portal shows the ACS URL, the entity ID and the audience. The IT admin registers them in their IdP.
A new IdP entity ID resets users’ links
A save that keeps the IdP’s entity ID updates the connection’s identity provider configuration in place and keeps every user’s link, including a certificate change. A save that changes the entity ID replaces the configuration and drops every user’s link to it. A returning user cannot link again by themselves.
Turn on SCIM
The IT admin can turn SCIM on and set its token. That is all the Admin Portal screen does for SCIM. Auto-deprovision, group sync and attribute mapping are set through the Admin Portal API only.
Status view
The portal shows each connection’s status and the last recorded health. It cannot run a connection check. It has no domain check, no on/off switch and no event view. Connection health runs on demand. There is no scheduled check.
Logo and accent colour
The portal header shows your customer’s logo, or a coloured initial if there is none. The Settings page shows the accent colour. You set both through the API only. No screen sets them.
Talk to the people who build it.
We run RealmSSO for you. Tell us which identity providers your customers use and how many customers you have, and we will tell you what fits today.