What you get
LeaveCalc supports SAML 2.0 Web Browser single sign-on, started from LeaveCalc (service provider initiated). People type their work email on the LeaveCalc log in page, choose Sign in with your company (SAML), sign in at your identity provider and land in LeaveCalc. You can also give them the company sign-in link from the LeaveCalc card.
Tested with test keys only. We have tested SAML sign-in with generated test keys and test responses. We have not yet run it against a live Okta, Microsoft Entra ID or Google Workspace tenant, and we do not claim certification or a listing with any identity provider vendor. The steps below follow each vendor’s own documentation, read on 8 October 2026. Vendor screens change: if yours differ, follow the vendor’s page and use the values in the table below.
Before you start
- A LeaveCalc owner account. Only an owner sees the setup card (Settings, Account, Single sign-on with SAML).
- The Business or Enterprise plan. A company on its free trial can set SAML up and try it.
- Access to the DNS settings of your email domain. One TXT record proves the domain is yours.
- An administrator account in your identity provider.
- LeaveCalc has no SCIM, so people are not added or removed from your identity provider automatically.
What LeaveCalc does not do
Read this first, so you can plan around it.
- It does not accept sign-ins that start at your identity provider portal (identity provider initiated, for example clicking an app tile). Use the company sign-in link as a bookmark, or as a bookmark tile, instead. The reason: such a response has no request to match it with, so a stolen or injected response cannot be told from a real one, and LeaveCalc could not protect against login CSRF.
- It does not sign its requests and does not read encrypted assertions, because it holds no private key. Turn assertion encryption off.
- It does not support single logout. Logging out of LeaveCalc ends the LeaveCalc session only.
- It reads the email address from the name ID (or from one attribute you name) and accepts only addresses at the domains you proved.
Values your identity provider asks for
Open Settings, Account, Single sign-on with SAML. Step 1 shows these values for your company. They contain a long random name that belongs to your company only (shown here as NAME). You can also download the LeaveCalc metadata as an XML file from the card, or give your identity provider the Entity ID address, which serves the same XML.
| Your identity provider calls it | Value |
|---|---|
| Entity ID, Audience, Audience URI, Identifier | https://leavecalc.com/api/v1/saml/NAME/metadata |
| ACS URL, Reply URL, Single sign-on URL, Recipient, Destination | https://leavecalc.com/api/v1/saml/NAME/acs |
| Binding for the response | HTTP POST |
| Name ID format | Email address |
| Name ID value | The user’s work email address |
| Signing | Sign the assertion (or the response, or both), RSA or ECDSA with SHA-256 or stronger. SHA-1 is refused |
| Encryption | Off |
| Start URL, Sign on URL, bookmark URL | The company sign-in link: https://leavecalc.com/app/#/login?sso=NAME |
Set up your identity provider
Pick your provider. Whichever you use, the values are the ones in the table above, the signature must be SHA-256 or stronger, and encryption must be off.
Okta
Source: Okta, Create SAML app integrations (help.okta.com/
- In the Okta Admin Console go to Applications, Applications, Create App Integration. Choose SAML 2.0 and press Next.
- Give the app a name, for example LeaveCalc. Press Next.
- Single sign-on URL: paste the ACS URL from LeaveCalc. Leave “Use this for Recipient URL and Destination URL” ticked. Okta does not allow underscores in this field, and the LeaveCalc address has none.
- Audience URI (SP Entity ID): paste the Entity ID from LeaveCalc.
- Name ID format: EmailAddress. Application username: Email. LeaveCalc sends no name ID policy in its request, so Okta uses what you choose here.
- Under the advanced settings: Response, Signed. Assertion Signature, Signed. Signature Algorithm RSA-SHA256, Digest Algorithm SHA256. Assertion Encryption, Unencrypted. Press Next, then Finish (“I’m an Okta customer adding an internal app”).
- Open the Assignments tab and assign the people or groups who may use LeaveCalc.
- On the Sign On tab, find the SAML metadata link (Metadata URL, or Identity Provider metadata). Copy its address, or open it and copy the XML. This is what you paste into LeaveCalc.
- Optional: add a Bookmark App in Okta whose URL is the company sign-in link, so people have a tile that works. The tile of the SAML app itself is identity provider initiated, and LeaveCalc refuses it with a plain message.
Microsoft Entra ID
Source: Microsoft Learn, Enable SAML single sign-on for an enterprise application (learn.microsoft.com/
- In the Microsoft Entra admin center go to Entra ID, Enterprise apps, New application, Create your own application. Name it LeaveCalc and choose “Integrate any other application you don’t find in the gallery (Non-gallery)”. Press Create.
- Open Users and groups and assign the people who may use LeaveCalc.
- Open Single sign-on and choose SAML.
- In Basic SAML Configuration press Edit. Identifier (Entity ID): the Entity ID from LeaveCalc. Reply URL (Assertion Consumer Service URL): the ACS URL from LeaveCalc. Sign on URL: the company sign-in link (this is what the My Apps tile uses). Save.
- In Attributes and claims check the Unique User Identifier (Name identifier). It must be the person’s work email address, for example
user.mail, with the name identifier format Email address. If your user principal names differ from the email addresses, change it touser.mail, or tell LeaveCalc the attribute name instead (step 2 of the LeaveCalc card, Email attribute). - In SAML Certificates keep the default signing option (Sign SAML assertion) and the SHA-256 signing algorithm. Copy the App Federation Metadata Url (or download the Federation Metadata XML). Paste it into LeaveCalc.
- When Entra renews the certificate (every three years by default), press Read the metadata address again in LeaveCalc. LeaveCalc keeps both certificates while they overlap. Do this before you make the new certificate active in Entra.
- The Test button in Entra starts an identity provider initiated sign-in or uses your sign-on URL, depending on the option. If it shows the LeaveCalc sentence about sign-ins that start at the company portal, that is expected. Use Test sign-in in LeaveCalc.
Google Workspace
Source: Google Workspace Admin Help, Set up your own custom SAML app (knowledge.workspace.google.com/
- In the Admin console go to Apps, Web and mobile apps, Add app, Add custom SAML app. Name it LeaveCalc.
- On the Google Identity Provider details page download the IdP metadata (the XML file) and keep it for LeaveCalc. Press Continue.
- Service provider details. ACS URL: the ACS URL from LeaveCalc. Entity ID: the Entity ID from LeaveCalc. Start URL: the company sign-in link. Signed response: optional (by default Google signs the assertion, and LeaveCalc accepts either). Name ID format: EMAIL. Name ID: Basic Information, Primary email. Press Continue, then Finish.
- Open the app, User access, and turn the service on for the organizational units or groups who may use it. Google says changes can take up to 24 hours, usually much less.
- In LeaveCalc choose Metadata XML and paste the file you downloaded.
- Test with Test sign-in in LeaveCalc. The Test SAML login button in the Google Admin console is identity provider initiated, and LeaveCalc refuses it with a plain message.
OneLogin and JumpCloud
Both should work with the same values, but we have not tested them, and the wording of their screens was not checked against their current help pages (the OneLogin field names are listed at support.onelogin.com/
- OneLogin: add the SAML Custom Connector (Advanced). Audience (EntityID): the Entity ID. Recipient and ACS (Consumer) URL: the ACS URL. ACS (Consumer) URL Validator: a regular expression that matches the ACS URL (escape the dots). SAML nameID format: Email. SAML signature element: Assertion (or Response). SAML initiator: Service Provider. Copy the issuer URL, the SAML 2.0 endpoint (HTTP) and the X.509 certificate into LeaveCalc by hand, or use the metadata address of the app.
- JumpCloud: SSO, Custom SAML app. SP Entity ID: the Entity ID. ACS URL: the ACS URL. SAMLSubject NameID: email, with the Email name ID format. Signature algorithm RSA-SHA256, sign the assertion. Login URL: the company sign-in link. Export the metadata and paste it into LeaveCalc.
In LeaveCalc
An owner opens Settings, Account, Single sign-on with SAML. There are four steps.
- Give the values to your identity provider (the table above).
- Add your identity provider. Choose Metadata address (an https address that LeaveCalc fetches itself; it must be reachable from the internet and must not point to a private network), Metadata XML (paste the file), or Enter by hand (entity ID, sign-in address, signing certificate). Certificates must be RSA 2048 bits or longer, or an elliptic curve P-256, P-384 or P-521, and not expired. If your identity provider lists several signing certificates (a rollover), LeaveCalc keeps up to four. The optional Email attribute is only for identity providers that do not send the email address as the name ID.
- Prove your domains. Add each email domain people sign in with. LeaveCalc shows a TXT record like
leavecalc-verify=0123456789abcdef0123456789abcdef. Add it to the DNS of that domain (at the domain itself, not at a subdomain name), wait a few minutes and press Check now. LeaveCalc looks it up over HTTPS at two public resolvers (Cloudflare and Google), and the domain shows Verified. A domain can be proved by one LeaveCalc company only. Optionally tick Create a viewer account for new people from the domain when they sign in. It is off by default: without it only people who already have a LeaveCalc account at your company can sign in. A viewer made this way can see people, requests and the calendar, but not FMLA cases, licences or the notes on a person. - Turn it on. Switch on Allow sign-in with SAML. Press Test sign-in and sign in with your own work email. After one successful sign-in you can switch on Require SAML for everyone.
Company sign-in link: https://leavecalc.com/app/#/login?sso=NAME. It opens the log in page with a button for your company. Give it to your people, or put it in a bookmark tile.
Changing the identity provider, removing it, switching SAML or Require SAML on or off, changing the email attribute and the viewer accounts switch of a domain all ask for your password, or for a sign-in made in the last 10 minutes. An owner who has no password (the account was made by a sign-in with a provider) signs in again instead. Every one of these changes sends an email to every owner of the company (who did it and when, never a certificate), so a change made from a stolen browser session does not stay unnoticed.
Proved domains are looked up again once a day. A domain stops being proved only after two answers “the record is not there” at least 24 hours apart (an answer such as “could not ask” counts for nothing), and the owners get an email when that happens. If it was the last proved domain, SAML sign-in and Require SAML are switched off. Keep the TXT record in DNS for as long as you use SAML.
Require SAML for everyone
With Require SAML for everyone on, passwords and Google or Microsoft sign-in stop working for the company. At the moment you switch it on, every session of the company ends, whatever way it was made (password, Google, Microsoft, one time code), except the one you are using in this browser and the sessions made by SAML itself.
- A session made by SAML lasts 12 hours at most, and not longer than the SessionNotOnOrAfter time of the assertion when your identity provider sends one, so people come back to the identity provider at least twice a day.
- Owners can still get in with a one time code sent to their email (the log in page offers it), so a wrong setting at the identity provider never locks the company out for good.
- The rule counts only while SAML is switched on, a domain is proved and the plan allows SAML.
- If the plan or the free trial ends while Require SAML is on, LeaveCalc keeps the requirement and SAML sign-in for 30 more days, so that a late payment does not open the door that the rule closed. Every owner gets an email when that starts and another when the 30 days are over. After that passwords work again by themselves and SAML sign-in stops. Your settings are kept, so they work again when the company is back on the Business or Enterprise plan. A company that does not require SAML loses SAML sign-in as soon as the plan ends.
What Require SAML does not cover
Read this before you tell your own auditors that “everyone signs in through the identity provider”.
- The owner one time code goes through email only. It is the way back in when SAML is misconfigured, and it does not go through your identity provider, so it does not use the multi-factor check your identity provider asks for. Whoever can read an owner’s mailbox can get in as that owner. Protect the mailboxes of owners with the multi-factor check of your email provider, and keep the number of owners small.
- The employee portal (the personal link people use to ask for time off without a LeaveCalc account) is not a sign-in and is not covered. It works as it did before.
- API tokens, the MCP connection for AI assistants and outbound webhooks are separate credentials made by owners. Require SAML does not end them and does not check them against your identity provider. Revoke them under Settings, Integrations (the card API tokens) when a person leaves.
- Slack buttons act for the person whose email the chat platform verified, without a LeaveCalc sign-in. They are not covered either. Remove a person from the Slack workspace, or disconnect the Slack app, when they leave. There is no Microsoft Teams app.
- Single logout is not offered. Ending a session at your identity provider does not end the LeaveCalc session, which ends by itself within 12 hours. Deactivate the person in LeaveCalc as well when they leave.
- Two-step sign-in. People who sign in with SAML are not asked for LeaveCalc’s own two-step code: your identity provider’s checks apply to them.
What LeaveCalc checks on every sign-in
For security reviewers. Every point has automated tests.
- The sign-in starts at LeaveCalc. The request id and a random one time state (RelayState) are stored on our side (only a keyed hash of the state), valid for 10 minutes, and tied to the browser that started it by a cookie.
- The response arrives by HTTP POST at the ACS address. It is limited to 256 KB, must be UTF-8 XML without any DOCTYPE or entity, and is parsed with entity resolution, DTD loading and network access off.
- Exactly one Assertion in the whole message, directly under the Response, no encrypted content, and every Signature element at one of the two allowed places.
- The signature is verified with a well reviewed library (signxml) against the certificates you saved in LeaveCalc only. Certificates and keys inside the message are ignored. SHA-1 is refused. The signature must have one Reference to the element that contains the signature, with the usual enveloped and exclusive canonicalization transforms. Only the data the library returns for the verified element is used, never an element found again in the original message, which defeats XML signature wrapping.
- Destination, Recipient and Audience are our exact addresses. InResponseTo is our request. NotBefore and NotOnOrAfter are checked with 3 minutes of clock difference allowed. The assertion id is remembered and cannot be used twice.
- The email address (name ID or the attribute) must be at a domain your company proved. It is matched to a person of your company only. An address that belongs to an account at another LeaveCalc company is refused, never linked.
- The browser that started the sign-in finishes it, with a one time ticket (login CSRF protection). The ticket rows are deleted 15 minutes after use. A made up link to the last step of a sign-in cannot end somebody else’s sign-in in progress.
- The session lasts at most 12 hours, and not past the SessionNotOnOrAfter time. A session of the company sign-in cannot connect a Google or Microsoft account to the person’s profile while SAML is on for the company.
- The limits count failures only (30 per network address and hour for each of the three steps), plus 2000 calls per hour for each step and company name, so an office behind one address is never locked out by working sign-ins.
- The DNS answers for the TXT proof come from two DNS over HTTPS resolvers and count only when the record belongs to the name that was asked about. A metadata address is fetched only from public IP addresses, over https, with one time limit for the whole fetch.
- The libraries LeaveCalc ships with are pinned by SHA-256, per file, and checked every time the process loads them. A changed, added or missing file stops SAML sign-in.
- Every change in the card and every sign-in or failed sign-in is written to the activity log with a short reason. The response, assertions and certificates are never written to a log.
If something does not work
| LeaveCalc says | Usual cause | What to do |
|---|---|---|
| does not accept sign-ins that start at your company portal | The sign-in started from an app tile or a Test button of the identity provider | Start from the LeaveCalc log in page or the company sign-in link |
| was not signed with the certificate LeaveCalc has on file | The identity provider renewed or replaced its signing certificate | Press Read the metadata address again, or paste the new metadata |
| signed with an algorithm LeaveCalc does not accept | The app signs with SHA-1 | Change the signature algorithm to RSA-SHA256 |
| did not match this sign-in (wrong address, audience or request) | Entity ID or ACS URL typed differently in the identity provider | Copy both values again from the LeaveCalc card, without spaces |
| too old or not valid yet | The clock of the identity provider is off by more than 3 minutes | Fix the clock, or try again |
| did not send an email address | The name ID is not the email address | Set the name ID to the work email address, or name the attribute that carries it |
| not at a domain your company has proved | The email domain was not added or the TXT record is missing | Add the domain in step 3 and check it |
| There is no LeaveCalc account for this email address | The person has no account and Create a viewer account is off | Invite the person, or switch on Create a viewer account for that domain |
| belongs to a LeaveCalc account at a different company | The same address already has an account at another company | The person needs a different address, or the other company must remove it. LeaveCalc never merges accounts |
| SAML is part of the Business and Enterprise plans | The plan ended or was changed | Upgrade, or sign in with a password |
Sources
Read for the design on 8 October 2026.
- OASIS SAML 2.0: Core, Bindings, Profiles and Metadata (docs.oasis-open.org/
security/ saml/ v2.0/). - OWASP SAML Security Cheat Sheet (cheatsheetseries.owasp.org/
cheatsheets/ SAML_Security_Cheat_Sheet.html). - Somorovsky and others, On Breaking SAML: Be Whoever You Want to Be, USENIX Security 2012.
- W3C XML Signature Best Practices (w3.org/
TR/ xmldsig-bestpractices/). - DNS over HTTPS JSON APIs of Cloudflare and Google Public DNS.
- The vendor pages named in the Okta, Microsoft Entra ID, Google Workspace and OneLogin sections.
Questions: use Ask the developer inside the app, or see the security overview.
Also: API reference · Zapier · Make · AI assistants (MCP)