Notion

This guide explains how to set up single sign-on (SSO) between VaultysHub and Notion using SAML 2.0.

Prerequisites

• Notion Enterprise Plan
• Administrator access to Notion
• Verified email domain in Notion
• Application configured in VaultysHub with SAML2

Note: SAML SSO is only available with Notion's Enterprise plan.

Configuration in VaultysHub

1. Create the application

1. Log in to VaultysHub as an administrator
2. Go to Applications → Add
3. Create a new application:
   • Name: Notion
   • URL: https://notion.so
   • Description: All-in-one workspace for notes and collaboration
   • Icon: Choose the Notion icon

2. Configure SAML2

1. In the Authentication tab
2. Select SAML2
3. Configure the following settings:
   • Entity ID: the Entity ID of the Service Provider provided by Notion (not the URL of VaultysHub)
   • ACS URL: https://www.notion.so/sso/saml
   • Format NameID: emailAddress
   • App ID: [appid] (automatically generated unique identifier)

3. Retrieve the metadata

Note the following URLs:

• IdP Metadata: https://[your-vaultyshub].link.vaultys.org/api/saml2/metadata/[appid]
• SSO URL: https://[your-vaultyshub].link.vaultys.org/api/saml2/sso/[appid]
• Entity ID: https://[your-vaultyshub].link.vaultys.org/[appid]
• X.509 Certificate: Download from VaultysHub

Single Logout from VaultysHub is not supported.

Configuration in Notion

1. Access SSO settings

1. Log in to Notion as an administrator
2. Go to Settings & Members
3. Click on Security & identity
4. In the SSO section, click on Configure SAML

2. SAML Configuration

Fill in the following fields:

Identity Provider Configuration

• Identity provider SSO URL: https://[your-vaultyshub].link.vaultys.org/api/saml2/sso/[appid]
• Identity provider issuer: https://[your-vaultyshub].link.vaultys.org/[appid]
• Public certificate: Paste the X.509 certificate from VaultysHub

Service Provider Configuration

• Entity ID: notion.so (generated by Notion)
• ACS URL: https://www.notion.so/sso/saml (generated by Notion)

3. Attribute configuration

Configure the SAML attribute mapping:

Notion Attribute	SAML Attribute	Required
Email	email	Yes
First Name	firstName	Yes
Last Name	lastName	Yes

4. Advanced configuration

Automatic provisioning

• Auto-provisioning: Enabled
• Update user info on login: Enabled
• Remove users on SCIM deprovision: According to your policy

Allowed domains

1. Add your company domains
2. Verify them via DNS (TXT record)
3. Enable Enforce SSO for these domains

Workspace configuration

Organizing workspaces

VaultysHub does not pass groups during SSO login (no groups attribute in the SAML assertion): access to workspaces is managed directly in Notion.

workspaces:
  - name: "Engineering"
    default_access: "member"
  
  - name: "Marketing"
    default_access: "guest"
  
  - name: "HR"
    default_access: "no_access"

Default permissions

Configure in Notion:

1. Settings & Members → Workspace settings
2. Default permissions:
   • Members can invite: disabled
   • Members can create groups: disabled
   • Members can export: enabled
   • Members can use API: enabled

Group and permission management

SCIM configuration (optional)

For automatic group synchronization:

{
  "scim_endpoint": "https://www.notion.so/scim/v2",
  "scim_token": "bearer_token_xxxxxx",
  "group_mappings": {
    "smartlink-admins": "workspace_admin",
    "smartlink-editors": "content_editor",
    "smartlink-viewers": "content_viewer"
  }
}

Available roles

Role	Permissions
Workspace Owner	Full access, billing management
Admin	Member and settings management
Member	Content creation and editing
Guest	Limited access to specific pages

Testing the configuration

1. Connection test

1. Open a private browsing window
2. Go to notion.so/login
3. Click on Continue with SAML SSO
4. Enter your company email
5. You are redirected to VaultysHub
6. After authentication, you access Notion

2. Application tests

• Desktop: The desktop application supports SSO via browser
• Mobile: iOS and Android support SSO
• Web Clipper: Browser extension compatible with SSO

3. API verification

// Test Notion API with authentication
const { Client } = require('@notionhq/client');

const notion = new Client({
  auth: process.env.NOTION_TOKEN,
});

async function testConnection() {
  const response = await notion.users.me();
  console.log(response);
}

Integration with Notion API

Integration configuration

1. Settings & Members → My connections
2. Develop or manage integrations
3. Create a new integration:

{
  "name": "VaultysHub Integration",
  "capabilities": {
    "read_content": true,
    "update_content": true,
    "insert_content": true
  },
  "oauth_redirect_uri": "https://[your-vaultyshub].link.vaultys.org/callback"
}

Webhooks for synchronization

// Webhook to synchronize changes
app.post('/webhook/notion', async (req, res) => {
  const { type, data } = req.body;
  
  switch(type) {
    case 'page.created':
      await syncNewPage(data);
      break;
    case 'database.updated':
      await syncDatabase(data);
      break;
  }
  
  res.status(200).send('OK');
});

Troubleshooting

Error "SAML configuration is invalid"

Problem: Incorrect SAML configuration

Solution:

1. Ensure the Entity ID is https://[your-vaultyshub].link.vaultys.org/[appid]
2. Check the format of the X.509 certificate (no extra spaces or line breaks)
3. Ensure the ACS URL is: https://www.notion.so/sso/saml

Error "User email domain not authorized"

Problem: The email domain is not verified

Solution:

1. In Notion → Security & identity → Domain management
2. Add and verify your domain
3. Add the TXT DNS record provided by Notion

Users are not automatically created

Problem: Auto-provisioning is not working

Solution:

1. Ensure Auto-provisioning is enabled
2. Make sure the required SAML attributes are present:
   • email
   • firstName
   • lastName
3. Check SAML logs in Notion

Group synchronization issue

Problem: Groups are not mapped correctly

Solution: VaultysHub does not pass groups in the SAML assertion. Manage groups directly in Notion, or via SCIM if you have configured it.

Security

Best practices

1. Enforce SSO: Enable SSO requirement for all users
2. Session timeout: Configure an appropriate session duration (8h recommended)
3. 2FA backup: Keep an admin account with 2FA as a backup
4. Audit logs: Regularly check logs in Settings → Audit log
5. API tokens: Manage API tokens for integrations separately

Advanced security configuration

{
  "security_settings": {
    "enforce_sso": true,
    "session_duration": "8h",
    "allow_public_sharing": false,
    "disable_guests": false,
    "disable_export": false,
    "watermark_exports": true,
    "audit_log_retention": "365d"
  }
}

Compliance and privacy

• GDPR: Notion is GDPR compliant
• SOC 2: Certification available
• Encryption: AES 256 at rest, TLS 1.2+ in transit
• Data localization: Choose your region (US/EU)

Migration of existing users

Migration script

import requests
import csv

def migrate_notion_users(csv_file):
    """Migrate users to SSO"""
    with open(csv_file, 'r') as file:
        reader = csv.DictReader(file)
        for row in reader:
            user_email = row['email']
            
            # Send SSO invitation
            send_sso_invitation(user_email)
            
            # Disable old access
            disable_password_login(user_email)
            
            print(f"Migrated: {user_email}")

def send_sso_invitation(email):
    # Logic to send the invitation
    pass

User communication

Email template for migration:

Subject: Migration to Single Sign-On (SSO) for Notion

Hello,

Starting from [DATE], we are migrating to single sign-on for Notion.

Required actions:
1. Use your work email to log in
2. You will be redirected to VaultysHub
3. Use your usual VaultysHub credentials

Benefits:
- One password to remember
- Enhanced security
- Simplified access

Support: [email protected]

Resources

• Notion SSO Documentation
• Notion API
• Notion Admin Guide
• SAML Configuration VaultysHub
• Notion Community Forum