Monday.com

This guide explains how to set up single sign-on (SSO) between VaultysHub and Monday.com using SAML 2.0 or OpenID Connect.

Prerequisites

• Monday.com Enterprise Plan
• Administrator access to Monday.com
• Verified email domain
• Application configured in VaultysHub with SAML2 or OpenID Connect

Note: SSO is only available with the Enterprise plan of Monday.com.

Configuration with SAML 2.0 (Recommended)

Configuration in VaultysHub

1. Create the application

1. Log in to VaultysHub as an administrator
2. Go to Applications → Add
3. Create a new application:
   • Name: Monday.com
   • URL: https://[your-account].monday.com
   • Description: Work management platform
   • Icon: Choose the Monday.com icon

2. Configure SAML2

1. In the Authentication tab
2. Select SAML2
3. Configure the following settings:
   • Entity ID: the Entity ID of the Service Provider provided by Monday.com (and not the URL of VaultysHub)
   • ACS URL: https://[your-account].monday.com/saml2/acs
   • Format NameID: emailAddress
   • App ID: [appid] (unique identifier generated automatically)

3. Retrieve the metadata

Note the following URLs:

• IdP Metadata: https://[your-vaultyshub].link.vaultys.org/api/saml2/metadata/[appid]
• SSO URL: https://[your-vaultyshub].link.vaultys.org/api/saml2/sso/[appid]
• Entity ID: https://[your-vaultyshub].link.vaultys.org/[appid]
• X.509 Certificate: Download from VaultysHub

Single Logout from VaultysHub is not supported.

Configuration in Monday.com

1. Access SSO settings

1. Log in to Monday.com as an administrator
2. Click on your avatar → Administration
3. In the menu: Security → Single Sign-On
4. Click on Set up SSO

2. SAML Configuration

Select SAML and configure:

• SSO URL: https://[your-vaultyshub].link.vaultys.org/api/saml2/sso/[appid]
• Entity ID: https://[your-vaultyshub].link.vaultys.org/[appid]
• Certificate: Paste the X.509 certificate from VaultysHub

3. Attribute configuration

Monday Attribute	SAML Attribute	Required
Email	email	Yes
First Name	firstName	Yes
Last Name	lastName	Yes

Configuration with OpenID Connect

Configuration in VaultysHub

1. Configure OpenID Connect

1. In the Monday.com application
2. Authentication tab → OpenID Connect
3. Note:
   • Client ID: monday-xxxxxx
   • Client Secret: secret-xxxxxx
   • App ID: [appid]

2. Redirect URLs

Add:

https://[your-account].monday.com/auth/oidc/callback

Configuration in Monday.com

1. In Security → Single Sign-On
2. Select OpenID Connect
3. Configure:

• Discovery URL: https://[your-vaultyshub].link.vaultys.org/api/oidc/[appid]/.well-known/openid-configuration
• Client ID: monday-xxxxxx
• Client Secret: secret-xxxxxx
• Scopes: openid profile email

Workspace Configuration

Organizational Structure

VaultysHub does not transmit groups during SSO login (neither in SAML nor in OpenID Connect): assignment to workspaces and teams is done directly in Monday.com.

workspaces:
  - name: "Marketing"
    default_role: "member"
    boards:
      - "Campaigns"
      - "Content Calendar"
      - "Social Media"
  
  - name: "Development"
    default_role: "member"
    boards:
      - "Sprint Planning"
      - "Bug Tracking"
      - "Feature Requests"
  
  - name: "Management"
    default_role: "viewer"
    boards:
      - "Company OKRs"
      - "Financial Reports"

Permissions and Roles

Role	Permissions
Owner	Full control of the account
Admin	User and settings management
Member	Content creation and editing
Viewer	Read-only
Guest	Limited access to certain boards

SCIM Configuration

For automatic user synchronization:

{
  "scim_endpoint": "https://[your-account].monday.com/scim/v2",
  "scim_token": "Bearer xxxxxx",
  "provisioning": {
    "create_users": true,
    "update_users": true,
    "deactivate_users": true,
    "sync_groups": true
  }
}

Automations with SSO

Authentication-based Workflows

automation:
  - trigger: "user_login_sso"
    conditions:
      - first_login: true
    actions:
      - create_board: "onboarding_template"
      - assign_to_team: "hr_team"
      - send_notification: "welcome_message"
      - add_to_board: "company_announcements"

Integration with the Monday.com API

API Configuration with SSO

const fetch = require('node-fetch');

class MondayAPIClient {
  constructor(apiKey) {
    this.apiKey = apiKey;
    this.apiUrl = 'https://api.monday.com/v2';
  }
  
  async getUserBySSOEmail(email) {
    const query = `
      query {
        users(emails: ["${email}"]) {
          id
          name
          email
          teams {
            id
            name
          }
        }
      }
    `;
    
    const response = await fetch(this.apiUrl, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Authorization': this.apiKey
      },
      body: JSON.stringify({ query })
    });
    
    return response.json();
  }
}

Webhooks for Synchronization

// Webhook to synchronize SSO changes
app.post('/webhook/monday-sso', async (req, res) => {
  const { event, userId, userEmail } = req.body;
  
  switch(event) {
    case 'user.created':
      await createUserWorkspace(userId, userEmail);
      break;
    case 'user.updated':
      await updateUserPermissions(userId);
      break;
    case 'user.deactivated':
      await archiveUserContent(userId);
      break;
  }
  
  res.status(200).send('OK');
});

Testing the Configuration

1. Login Test

1. Log out of Monday.com
2. Go to https://[your-account].monday.com
3. Click on Log in with SSO
4. Enter your corporate email
5. Authenticate via VaultysHub
6. Verify access to Monday.com

2. Permissions Test

# Test via the API
curl -X POST https://api.monday.com/v2 \
  -H "Authorization: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ me { name email teams { name } } }"}'

3. Mobile Test

The Monday.com apps support SSO:

• Monday.com iOS/Android
• Monday.com Desktop (Windows/Mac)

Troubleshooting

"SAML assertion failed" Error

Problem: The SAML assertion is rejected

Solution:

1. Verify that the Entity ID is https://[your-vaultyshub].link.vaultys.org/[appid]
2. Check the NameID format: emailAddress
3. Ensure that the email exists in Monday.com
4. Check the logs: Administration → Activity Log

"User not authorized" Error

Problem: The user cannot access

Solution:

1. Verify that the email domain is verified
2. Ensure that the user is invited to Monday.com
3. Check SCIM groups if configured

Groups are not synchronized

Problem: Monday teams do not match VaultysHub groups

Solution: this is the expected behavior. VaultysHub does not transmit groups in the SAML assertion: manage teams directly in Monday.com.

Problem with Automations

Problem: Automations do not trigger for SSO users

Solution:

1. Verify that the user has the necessary permissions
2. Ensure that the automation is enabled for "All users"
3. Test with a non-SSO account to isolate the problem

Security

Recommended Configuration

{
  "security_settings": {
    "enforce_sso": true,
    "session_duration": "8h",
    "ip_restrictions": {
      "enabled": true,
      "whitelist": ["10.0.0.0/8", "192.168.0.0/16"]
    },
    "2fa_backup": true,
    "audit_retention": "365d",
    "api_token_expiry": "90d",
    "guest_restrictions": {
      "disable_export": true,
      "disable_api_access": true,
      "view_only": true
    }
  }
}

Compliance

• SOC 2 Type II: Certified
• ISO 27001: Certified
• GDPR: Compliant with DPA available
• HIPAA: Compliant (Enterprise+ plan)

User Migration

Migration Script

import requests
import csv
from datetime import datetime

class MondaySSOMigration:
    def __init__(self, api_key, account_id):
        self.api_key = api_key
        self.account_id = account_id
        self.api_url = "https://api.monday.com/v2"
    
    def migrate_users(self, csv_file):
        """Migrate users to SSO"""
        with open(csv_file, 'r') as file:
            reader = csv.DictReader(file)
            results = []
            
            for user in reader:
                result = self.migrate_single_user(user)
                results.append(result)
                
        return results
    
    def migrate_single_user(self, user):
        # Disable password authentication
        # Send SSO invitation
        # Log the result
        pass

Resources

• Monday.com SSO Documentation
• Monday.com API Documentation
• Monday Apps Marketplace
• SAML Configuration VaultysHub
• Monday Community Forum