Skip to main content

​
Login

​
Sources

Docs: Protection Primer Web App: Sign in from your Workspace address. Workspace managers configure the method from Protection → Login. Parable supports a simple email path and Workspace-managed identity providers. The sign-in screen shows the methods available for the Workspace you are trying to reach. It has no heading: each button names its method. The page does not show the name of the Workspace you are trying to reach.

​
Sign in

A Last used badge on the top edge of a button marks the method that this browser used for its last successful sign-in. The mark is the cookie parable_last_auth_method_production. It holds only the method name: google, email, or sso. It holds no email address, no user ID, and no Workspace. The cookie lasts 400 days, and the browser keeps it after you sign out. To remove the mark, clear the cookies for Parable in your browser.

​
Continue with your identity provider

Choose Continue with Google when your Workspace uses Google sign-in. The button follows Google’s sign-in button design: the light button in the Ivory theme and the dark button in the Obsidian theme. After you choose it, a spinner replaces the Google logo until Google’s page opens. For OIDC or SAML, open the Workspace address your manager gave you. While you are signed out it shows the Single sign-on page; choose Sign in with SSO to continue to the Workspace’s identity provider. The Login URL a Workspace manager copies into the provider opens the same page. Complete authentication with the provider. Parable never asks you to paste the provider password, client secret, or provisioning token into the sign-in page.

​
Continue with email

Choose Continue with email (the button with the envelope), enter your work address, and follow the short-lived instructions sent to that inbox. Use the newest sign-in message and complete it in the same browser where you started. If it expires, return to the sign-in page and request another one.
Treat a sign-in link or code like a password. Do not forward it, paste it into chat, or include it in a screenshot.

​
Join from an invite

An invite email from People is a one-time link that signs you in and adds you to the Workspace. It expires after seven days; ask the person who invited you to resend it. After you accept an invitation, use your Workspace address to return to Parable. If you open the invitation again, the page says Invitation already accepted. Choose Sign in to request a new sign-in link or code for your existing account. You do not need another invitation. An invite sent while the Workspace uses OIDC or SAML, and any reminder for it, opens the Workspace’s single sign-on page (<workspace>.parable.work/auth/sso) instead, because email alone does not satisfy single sign-on. Sign in with your identity provider there, and Parable activates your membership with the role you were invited with. Single sign-on and SCIM cannot add an email that already has a Parable account in another Workspace, or that belongs to Parable staff. Your identity provider controls which email it sends, so Parable does not let that email alone join an existing account to this Workspace. The sign-in page then says that single sign-on cannot add this email. Ask your Workspace administrator to sign you in with a different email. Today no other path adds such an account to a single sign-on Workspace.

​
Configure the Workspace login method

Workspace managers open Protection → Login. Magic Link is active for a new Workspace, so the team has a working path before SSO is configured. Only one login method can be active at a time. You cannot turn off the active method by itself; configure and validate another method, then activate the replacement. Magic Link needs no provider configuration. Leave it active while you prepare and test another method. It is also the lowest-complexity choice for a Workspace that does not require centralized SSO.

​
Social Login

Open Social Login, choose the provider used by the team, and activate it. People sign in with the matching Google or Microsoft account, and the email returned by that provider must match their Workspace identity.

​
OIDC

Open OIDC (OpenID Connect) and enter the values supplied by your identity provider:
  • Issuer URL identifies the provider.
  • Client ID identifies the Parable application registration.
  • Client secret authenticates that registration and must remain private.
  • Default role for new people sets the starting Workspace access for SSO sign-ins, SCIM provisioning, and invitations an agent such as Ponder sends. Only a person sets it.
Copy the displayed Login URL to the provider. Save the connection to obtain the Redirect URI, then add that value to the same provider application. The example uses a fictional Workspace and synthetic URL. Your values come from your own Workspace and identity-provider application. Run Test connection after both sides are configured. Activate OIDC only after the test succeeds.

​
SAML

Open SAML and enter the identity provider’s entity ID, SSO URL, and public verification certificate. Save the connection, then copy Parable’s ACS URL, audience URI, and service-provider certificate into the provider. Configure the provider to send the exact email, first-name, and last-name attributes shown in Parable. Test before activation. Plan certificate rotation before either the identity-provider or service-provider certificate expires.

​
Enable automatic provisioning with SCIM

After compatible SSO setup is complete:
  1. Choose the default Workspace role for newly provisioned people.
  2. Enable Automatic user provisioning (SCIM).
  3. Copy the SCIM endpoint URL and bearer token directly into the identity provider.
  4. Send a small test assignment from the provider.
  5. Confirm the person appears with the expected Workspace role before assigning the full group.
SCIM does not add a person whose email already has a Parable account in another Workspace, or that belongs to Parable staff. That person does not appear in People. Assign them a different email in the identity provider. The bearer token is displayed as a secret. Store it in the provider or your approved secret manager; never put it in documentation, screenshots, source control, or Ponder.

​
Troubleshooting

If the active method is failing for everyone, contact the Workspace’s designated recovery owner or Parable support. Do not regenerate secrets or change several provider settings at once unless you have a tested recovery path. Workspace administrators choose the login methods members may use. Keep at least one method selected when saving the login policy. The Workspace API’s PUT /api/auth/login-methods applies the same rule: allowedMethods must be present and contain at least one method. An omitted value, null, or an empty array is rejected before the policy is saved. This prevents an empty selection from clearing the Workspace’s login methods.