TABLE OF CONTENTS
ADMIN PRIVILEGES REQUIRED
Overview
This article answers common questions about managing SAML certificates and configuring System for Cross-domain Identity Management (SCIM) for Stack Internal Enterprise.
Certificate management
How do I update my Identity Provider (IdP) certificate?
SAML certificate updates are handled by a Stack Internal Enterprise admin user. For privacy and security reasons, Product Support doesn't have access to your site's data or UI.
- Go to Admin Settings, then Authentication, and scroll to the Identity provider certificates section.
- Click Add another certificate.
- Paste the Base64-encoded public key from your Identity Provider (IdP) into the new field.
- Click Validate certificate under the field and check the metadata to confirm the new certificate is valid now and stays valid for the coming weeks and months.
- If validation succeeds, scroll down and click Save settings.
If the Update certificates from federation metadata URL field has a value, it is not possible to manually add or remove certificates, as Stack Internal Enterprise expects to receive new certificates via that URL instead.
How do I resolve a 'signature could not be validated against the x509 certificate' error?
An error stating that the signature of the response from your Identity Provider (IdP) couldn't be validated against the certificate usually means your IdP is signing responses with a certificate your site doesn't currently trust. This isn't always an expiration issue. It's more often caused by a certificate rotation on the IdP side that wasn't matched on the Stack Internal Enterprise site, or a recent SSO configuration change.
Work with your IdP administrator to check the following:
- The IdP is signing the SAML response for your site.
- The certificate or key the IdP uses to sign that response matches the certificate your site trusts.
- Any recent certificate rotation or configuration change was applied consistently on both sides.
- Affected users remain assigned to the SAML application for your site.
If an admin still has an active session, they can update the trusted certificate directly in Admin Settings, then Authentication.
If every admin is locked out, contact Stack Overflow Product Support with your Identity Provider's current public signing certificate in Base64 x.509 format.
For security, only send the public signing certificate. Don't send private keys, PFX passwords, client secrets, or user credentials.
Product Support will then update the certificate and let you know once it's done so you can try logging in again.
SCIM
Does Stack Internal Enterprise support user creation via SCIM?
Yes. Stack Internal Enterprise supports System for Cross-domain Identity Management (SCIM) integration, which lets your Identity Provider (IdP) automatically create, deactivate, reactivate, and permanently delete users. SCIM can also promote or demote user roles and update a user's display name, real name, verified email address, department, and title.
Unlike SAML single sign-on, which passes user information only at login, SCIM sends updates whenever they happen on the IdP side. This gives Stack Internal Enterprise near-real-time updates to user status and role.
How do I set up SCIM on Stack Internal Enterprise?
Enable SCIM in Admin Settings, then SCIM, and generate an authorization bearer token for your Identity Provider (IdP). Your IdP then sends SCIM requests to https://[your_site].stackenterprise.co/api/scim/v2.
Enabling SCIM support does not disable user management options within Stack Internal Enterprise. This means a user may have an active status in the IdP, yet be deactivated in Stack Internal Enterprise through the admin user management settings. We recommend standardizing on a single provisioning workflow within your organization to avoid confusion.
For full setup steps, including IdP-specific configuration for Okta, OneLogin, and Microsoft Entra ID, see System for Cross-domain Identity Management (SCIM) 2.0 Support.
How do I deactivate users via SCIM?
Once SCIM is set up, your IdP controls deactivation and reactivation by sending the active field as true or false.
To help prevent unintentional user deletion with SCIM, Stack Internal Enterprise enables this feature only for supported customers on a case-by-case basis.
To enable or disable it, open a support ticket with Product Support.
How do I enable SCIM user deletion?
SCIM user deletion is off by default because it permanently removes users and Stack Internal Enterprise can't reverse it. To enable it:
- Contact Stack Overflow Product Support and confirm you understand user deletion is irreversible.
- Provide written acknowledgment that you've read the SCIM 2.0 User Deletions documentation and accept full responsibility.
- Product Support will send you a direct link to the
Auth.SCIMEnableUserDeletionsite setting. - Log in as an admin, access the link, set
Auth.SCIMEnableUserDeletiontoTrue, and click Save new network default.
See Automated User Deletion with SCIM for how to delete users through your IdP or the SCIM API.
Can SCIM promote or demote user roles?
Yes. Go to Admin Settings, then SCIM, and enable Promote to moderator and/or Promote to admin in the "User promotion" section.
See System for Cross-domain Identity Management (SCIM) 2.0 Support for the required IdP field values.
Can SCIM update a user's profile information?
Yes. Go to Admin Settings, then SCIM, and enable Update display name and/or Update real name. SCIM can also update a user's department and title, which lets you use Stack Internal Enterprise's connectivity reporting feature.
See System for Cross-domain Identity Management (SCIM) 2.0 Support for the required IdP field values.
Get help
If you have questions or issues, reach out to our support team for help.