MaleusMaleus

Configure single sign-on

Wire one or more identity providers so your team signs in with corporate credentials. Provisioned users land in the Team page where you can adjust their role.

In the appSettings · SSO
On this page

Single sign-on lets your team authenticate against your own identity provider. The page lives at Settings → SSO.

Add a provider

  1. Click Add Provider. A dialog opens.
  2. Pick the protocol (SAML, OIDC, etc., depending on what your provider supports).
  3. Fill in the provider metadata: issuer, callback URL, certificate or client secret as required.
  4. Save. The provider appears in the list.

The exact fields depend on the provider type. Have the metadata from your identity provider's console ready before you start.

Manage existing providers

Each entry in the list opens a view / edit dialog. From there you can:

  • Rotate secrets.
  • Update the metadata if your provider rotates its keys.
  • Disable a provider temporarily.
  • Delete it.

Provisioning users

Once a provider is wired, new users sign in with their corporate credentials on their first visit. They land in the workspace Team list with the default role. From Settings → Team, an admin can upgrade them to Admin or remove them.

Default new SSO users to User at the workspace level. Promote project access on demand instead of granting wide privileges by default. See Invite teammates to your workspace for the role model.

Disable password sign-in

If you want to enforce SSO only, disable any non-SSO sign-in method from the same page. Make sure at least one Admin can sign in via SSO before you do this, otherwise you lock yourself out.