SpectraAn attacker's view, one move ahead.
JAENSign in

SSO and source IP restrictions

Available for Business and MSP organizations. Only OWNER can change these settings.

Configure SSO

  1. Add your email domain under SSO in Settings → Security. Publish the displayed TXT record at _spectra-sso.your-domain with value spectra-sso=verification-value, then verify it.
  2. Paste and save your IdP’s metadata XML.
  3. Register the displayed ACS URL and entity ID with your IdP. NameID must be an email address (emailAddress) on a verified domain for this organization.
  4. Successfully test SSO before enabling it. The test email must be the OWNER’s primary or verified additional address. Requests expire after 5 minutes; start again if expired.
  5. An OWNER signed in through that organization’s SSO can make SSO required. Its data is then accessible only from a session signed in through that organization’s SSO.

Copy the values from “Values to register with your IdP” on the same page. The ACS URL uses /api/sso/saml/acs/organizationID and the entity ID uses /sso/saml/organizationID, both prefixed with the service origin.

Joining and signing in

First-time SSO users join as VIEWER. A new member cannot join when members plus valid pending invitations reach the plan limit. An unverified domain also prevents sign-in.

Addresses on verified domains with active SSO do not receive email sign-in links and cannot use passkeys. This routing applies independently of the “required” setting.

Renew an IdP certificate

Paste and save metadata containing the new signing certificate, successfully test again and enable SSO. Saving metadata disables SSO, so plan the cutover.

Source IP restrictions

Under Access restrictions in Settings → Security, add allowed IP addresses or CIDR ranges and enable the policy. IPv4 / IPv6 are supported, with up to 50 entries. The policy covers organization data in the browser and the audit log API.

Enabling the policy or deleting an entry cannot exclude your current source IP. If access fails at home or through a VPN, ask the OWNER to check whether its egress IP is allowed.

Lockout and plan changes

Contact support if locked out. An operator can disable IP restrictions or clear the SSO requirement after verifying your identity. Clearing the requirement does not necessarily restore email sign-in links for SSO domains; confirm which setting is being reset.

When the plan becomes ineligible, SSO and IP restrictions stop applying while their saved settings remain.

Contact: support（at）elf.ne.jp (if no link appears, replace （at） with @).