Skip to main content

Integrate with Productive

Support level: Community

What is Productive?​

Productive is a professional services automation platform for agencies, consultancies, and other service businesses. It includes tools for resource planning, time tracking, project management, CRM, budgeting, invoicing, forecasting, and reporting.

-- https://productive.io/

Preparation​

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.
info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

Productive requirements

Single Sign-On (SSO) is available on all Productive plans. Enforcing SSO and SCIM provisioning require Productive's Ultimate plan. To let Productive create users automatically from SSO or SCIM, make sure each authentik user has an email address and a full name with a first and last name. Before enabling SCIM, make sure your Productive workspace has enough seats for the users that will be synchronized.

authentik configuration​

To support the integration of Productive with authentik, you need to create two property mappings and an application/provider pair in authentik.

For optional SCIM provisioning, create the SCIM property mapping now. After you enable SSO and SCIM in Productive, return to the optional SCIM provider sections to finish the authentik configuration.

Create property mappings​

Productive expects the SAML assertion to include first_name and last_name attributes. Because authentik stores a user's full name as a single string, create SAML provider property mappings that split the full name into first and last names.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings and click Create.

  3. Select SAML Provider Property Mapping as the type and click Next.

  4. Create a property mapping with the following values:

    • Name: Productive first name

    • SAML Attribute Name: first_name

    • Expression:

      name = request.user.name or request.user.username
      return name.split(" ", 1)[0]

  5. Click Finish.

  6. Repeat steps 2-5 to create the following additional SAML provider property mapping:

    • Name: Productive last name

    • SAML Attribute Name: last_name

    • Expression:

      name = request.user.name or request.user.username
      return name.rsplit(" ", 1)[-1] if " " in name else ""

Create an application and provider​

SAML provider changes in authentik 2026.5

authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the Issuer value to: https://authentik.company/application/saml/<application_slug>/metadata/

Older versions of authentik set this value to authentik by default. If you're running an older version, please set Issuer to https://authentik.company/application/saml/<application_slug>/metadata/, where <application_slug> is the slug that you selected for the application.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click New Application to open the application wizard.

    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Take note of the Slug as it will be required later.
    • Choose a Provider type: select SAML Provider as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Temporarily set ACS URL and Audience to https://temp.temp. You will replace these values after completing the Productive configuration.
      • Under Advanced protocol settings:
        • Select an available Signing Certificate.
        • Toggle on Sign responses.
        • Set NameID Property Mapping to authentik default SAML Mapping: Email.
        • Under Property mappings, add the property mappings that you created in the previous section.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page. If you add the SCIM provider as a backchannel provider later, only users who can view this application are synchronized.

  3. Click Submit to save the new application and provider.

Create a SCIM property mapping (optional)​

authentik can also provision Productive users with SCIM. SCIM requires SSO to be configured first.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings and click Create.

  3. Select SCIM Provider Mapping as the property mapping type and click Next.

  4. Set the following values:

    • Name: Productive SCIM user

    • Expression:

      name = request.user.name or request.user.username
      given_name, family_name = name, " "
      formatted = name + " "
      if " " in name:
          given_name, _, family_name = name.partition(" ")
          formatted = name

      user_name = request.user.email or request.user.username

      emails = []
      if request.user.email:
          emails = [{
              "value": request.user.email,
              "type": "work",
              "primary": True,
          }]

      return {
          "userName": user_name,
          "name": {
              "formatted": formatted,
              "givenName": given_name,
              "familyName": family_name,
          },
          "active": request.user.is_active,
          "emails": emails,
      }

  5. Click Finish.

Create a SCIM provider (optional)​

Complete this section after you enable SCIM in Productive and copy its Base URL and Bearer Token.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Providers and click Create to open the provider wizard.

    • Choose a Provider type: select SCIM Provider as the provider type.
    • Configure the Provider: provide a name for the provider, and the following required configurations.
      • URL: the Base URL value from Productive.
      • Token: the Bearer Token value from Productive.
      • Under Attribute mapping:
        • Remove authentik default SCIM Mapping: User from Selected User Property Mappings and add Productive SCIM user.

  3. Click Finish to save the provider.

Set the SCIM provider as a backchannel provider (optional)​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Applications and click the name of your Productive application.
  3. Click the plus (+) icon next to Backchannel Providers and select the SCIM provider that you created in the previous section.
  4. Click Save Changes.

Productive configuration​

Configure SAML SSO​

  1. Log in to Productive as an administrator.
  2. Navigate to Settings > SSO and SCIM.
  3. Copy the Single Sign-On URL and Audience URI values. You will use these values in the next section.
  4. Keep the Productive SSO settings open.

Update the authentik provider​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Providers and click the provider that you created in the previous step.
  3. Click Edit.
  4. Under Protocol settings, set ACS URL to the Single Sign-On URL value from Productive. Then, set Audience to the Audience URI value from Productive.
  5. Click Update.

Enable SSO​

  1. Return to the Productive SSO and SCIM page.
  2. Set the following values:
    • Metadata URL: https://authentik.company/application/saml/<application_slug>/metadata/
    • Identity Provider Single Sign-On URL: https://authentik.company/application/saml/<application_slug>/
  3. Click Enable SSO.

Enable SCIM (optional)​

  1. Log in to Productive as an administrator.
  2. Navigate to Settings > Single Sign-On > SCIM.
  3. Open the SCIM section and click Enable SCIM.
  4. Copy the Base URL and Bearer Token values.
  5. Return to the optional Create a SCIM provider section under authentik configuration to finish the SCIM setup.

Configuration verification​

To confirm that authentik is properly configured with Productive, open Productive in a private or incognito browser window. Click Use Single Sign-On (SSO), sign in with authentik, and confirm that you are redirected back to Productive.

To confirm that SCIM is properly configured, open the Productive SCIM provider in authentik and click the run button on the Full sync for SCIM provider task. After the sync completes, verify that users with access to the Productive application are provisioned in Productive.

Resources​