Help · MANTIS guide

Enterprise SSO setup

Connect MANTIS to your organization’s OpenID Connect provider. This guide covers the MANTIS-specific requirements; use your provider’s normal application-registration process.

Connection requirements

Setting	MANTIS requirement
Protocol	OpenID Connect, Authorization Code flow with PKCE `S256`. SAML is not supported by this integration.
Scopes	`openid email`
Issuer and endpoints	Exact HTTPS issuer, authorization endpoint and token endpoint URLs for your tenant.
Token endpoint authentication	`client_secret_basic`, `client_secret_post` or `none`, matching the registered application. A client secret is required only for the first two methods.
ID token	Stable `sub`, the configured `iss` and client audience, and valid `nonce`, `iat` and `exp` claims. Supported token algorithms: `RS256`, `PS256` and `ES256`.
Email invitations	First-time email invitation linking requires the exact invited `email` and `email_verified: true`. When this claim is unavailable, discuss explicit subject mapping with MANTIS support.

Register the callback URLs

Use the exact callback URLs supplied for your connection. Do not use wildcards or add a trailing slash.

Website: https://getmantis.net/api/v1/auth/enterprise/callback
Extension: https://ogbfhbddfgabkekdehhbjanciimnnkmi.chromiumapp.org/enterprise/<workspace>/<connection>. Replace the workspace and connection placeholders with the names agreed with MANTIS support.

The extension callback uses the published extension identity. Current published MANTIS version: 0.6.6. Callback values are also shown on Enterprise → Setup SSO after a connection is registered.

Have MANTIS register the connection

Your identity administrator configures the application in your identity provider. MANTIS support currently registers the corresponding connection on the MANTIS server. The Account page enables or disables registered connections; it does not collect provider client secrets.

Provide the workspace ID, a short connection name, issuer and endpoint URLs, client ID, token endpoint authentication method, and the work-email domains to associate with this connection. Send any required client secret separately through a secure channel. The workspace encryption key is not part of this configuration and must not be sent to support.

Once registration is complete, refresh Enterprise → Setup SSO. The workspace owner can enable the connection. Disabling it revokes its active Enterprise sessions.

Invite members and test sign-in

Enable the connection, then open Enterprise → Manage users. Invite a member by their verified work email and select the connection.
Share the generated workspace sign-in link. If the member already has a MANTIS account, they sign in to that account with their existing method before linking SSO. A new user can be created after their invited email is verified by the provider.
Complete your provider’s sign-in and MFA flow. Confirm that MANTIS opens the expected workspace and that the user has the intended member or administrator role.

Email-domain routing on the Account website is available only for a verified domain with one eligible enabled connection. Otherwise, use the exact workspace sign-in link. Matching an email domain alone does not grant membership.

Workspace encryption is separate

SSO proves a user’s identity and controls access. The optional workspace encryption key protects shared records in the browser before upload. SSO works without a key. Configure encrypted sharing under Enterprise → Set Encryption. If encrypted sharing is used, authorized members need the same key; MANTIS stores only an encrypted verification value and cannot recover the raw key. Keep a recovery copy in your organization’s password manager.

Troubleshooting

No connection to enable: MANTIS support has not yet registered a provider for this workspace.
Redirect rejected: compare the exact callback URL, workspace and connection name with the application registration.
Identity could not be verified: check issuer, client ID, token endpoint authentication, ID-token claims and clock accuracy.
Workspace access unavailable: check the invitation, verified email, connection status and workspace license.
Existing account must be linked: sign in with that account’s current method, then retry the workspace SSO link.

For support, share the timestamp, workspace and connection names, and the provider’s error or correlation ID. Do not include tokens, authorization codes, client secrets or workspace encryption keys.