Articles on: Enterprise, SSO & security

Single sign-on (SSO) for SimplyPrint: overview and setup guides

Single sign-on (SSO) for SimplyPrint: overview and setup guides


Single sign-on lets the members of your account sign in to SimplyPrint with the login they already use at your school or organization, instead of a separate SimplyPrint password. SimplyPrint supports two SSO protocols, SAML and OpenID Connect (OIDC). This overview explains the difference, how SimplyPrint identifies users, and links every setup guide so you can jump straight to yours.


Single sign-on is included in the Enterprise plan and the School plan. Print Farm accounts that subscribed before 2026-05-15 keep SSO as well. See the pricing page for the full plan comparison.


SAML or OIDC, which should you use?

Both protocols do the same job: your members sign in with your identity provider (IdP) instead of a SimplyPrint password. There's no difference for your members once it's live, so pick whichever your IdP supports best.


  • OIDC is the modern option and usually the quickest to set up. SimplyPrint discovers your provider's endpoints automatically, so you normally only paste in an issuer URL, a client ID, and a client secret. Good default for Microsoft Entra ID, Google Workspace, Okta, Auth0, Keycloak, and Authentik.
  • SAML is widely used in education and enterprise. You exchange a metadata file and a signing certificate. Choose SAML if your provider only offers SAML, if you already run it, or if you connect through an identity federation.
  • Federation (InCommon, eduGAIN, WAYF, and other Shibboleth-based federations) is SAML only. If your institution signs in through a federation, use the federation guide below.


Your account runs one SSO method at a time, either SAML or OIDC, never both. Turning on one deactivates the other but keeps its saved configuration, so you can switch back later without re-entering everything.


How SimplyPrint identifies users

SimplyPrint identifies each member by the stable identifier your provider sends, the SAML NameID or the OIDC sub claim, not by email. Email, name, and groups are treated as attributes that can change at any time without affecting the account.


This matters when someone's email changes or a person accumulates several affiliations over time: as long as your provider keeps sending the same stable identifier, they stay a single SimplyPrint account. When you configure SAML, our service metadata requests the persistent NameID format. Release a stable, non-reassignable identifier as the NameID or sub, for example a NetID, an eduPersonPrincipalName, or a persistent per-user ID, rather than a value that could be reused for a different person later.


Set up SAML


Set up OIDC


After setup: signing in, linking and provisioning


Troubleshooting

Updated on: 07/07/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!