Getting Started
- What is TestInvite?
- Build Your First Test
- Run Your First Assessment
- Taking the Assessment
- Viewing the Results
- Question Bank Overview
- Common Question Features
- Scoring
- Question Types
- Question Authoring
- Browsing Questions
- Content Blocks
- Media Library
- Metadata Rules & Schema
- Tests Overview
- My Tests
- Creating a Test
- The Test Editor
- Test Settings
- Sections & Pages
- Adding Questions
- Page Builders
- Test Profile
- Reporting
- Test Papers
- Analytics
- Publishing a Test
- Test Library
- Marketplace
- Tasks Overview
- Creating a Task
- Task Dashboard
- Steps
- Task Settings
- Candidates
- Test Sessions
- Sent Mails
- Proctoring
- Analytics
- Analytics Overview
- Test Analytics
- Question Analytics
- Per-Question Analytics
- Results Explorer
- Segment Analysis
Organization
Single Sign-On (SSO)
Set Up SSO with Any SAML or OIDC Identity Provider
Any identity provider that speaks standard SAML 2.0 or OpenID Connect works with TestInvite; this page lists exactly what TestInvite sends, what it expects back, and which values go where.
Published 2026/10/19
Use this page for OneLogin, PingFederate / PingOne, JumpCloud, Auth0, CyberArk, Shibboleth, Authentik and every other standards-based identity provider. Replace <ORG-ID> with your TestInvite organization ID.
Generic SAML 2.0
In your identity provider
| Setting | Value |
|---|---|
| Easiest | Import TestInvite's metadata: https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/metadata |
| SP Entity ID / Audience | https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/metadata |
| ACS URL (HTTP-POST) | https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/acs |
| Login / start URL | https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/initiate |
| Signing | Sign the response, the assertion, or both (RSA-SHA256 recommended) |
| Name ID | Email address recommended; any format is accepted |
| Attributes | Email (required unless the Name ID is the email), first name, last name or display name |
| Encryption | Optional; use the encryption certificate from TestInvite's metadata |
| Single logout | Not used; leave empty |
In TestInvite
Import your identity provider's metadata URL or upload its metadata file. Or enter by hand: the identity provider's Entity ID, its SSO URL for the HTTP-Redirect binding, and its signing certificate.
Generic OpenID Connect
| Setting | Value |
|---|---|
| Application type | Web application / confidential client |
| Grant type | Authorization Code (PKCE S256 is always sent) |
| Redirect URI | https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/oidc/callback |
| Token endpoint authentication | client_secret_basic or client_secret_post |
| Scopes | openid, email, profile |
| ID token | Signed (keys published at the JWKS URL); must contain the email, or the userinfo endpoint must return it |
In TestInvite, enter the issuer URL (TestInvite reads <issuer>/.well-known/openid-configuration), the client ID and the client secret.
What TestInvite sends
- SAML: an AuthnRequest over HTTP-Redirect, with a unique ID, the ACS URL and TestInvite's issuer; no NameIDPolicy and no requested authentication context; signed only when Sign authentication requests is on.
- OIDC:
response_type=code,client_id,redirect_uri,scope,state,nonce,code_challenge(S256),response_mode=query, andlogin_hintwhen the user typed an email on the sign-in page.