Single sign-on
Let people sign in with your organization's identity provider.
Team-tier, and organization admins only. On a solo account the SSO entry is not in the settings menu at all — it is hidden rather than left as a dead end, because the endpoint behind it refuses a solo user anyway. Every Early Access account is solo, so if you are reading this during Early Access, you will not find SSO in your own settings. This page describes what it does for an organization that has it.
With SSO configured, people sign in with Continue with single sign-on rather than an AODex password.
What you see, and when
There are three different things behind the SSO entry, depending on the account:
| Who | What the SSO screen shows |
|---|---|
| Solo account (including Early Access) | Nothing — the SSO entry is not in the menu. |
| Team member who is not an organization admin | Organization admin access required — SSO configuration is managed by organization admins. Contact your admin to request access. |
| Organization admin | The configuration itself: the OIDC or SAML fields below, the two options, and Edit SSO Configuration. |
The screenshot below is the middle case — a team account signed in as an ordinary member, not an admin. It is what most people in an organization will see, and it is a permissions message rather than a fault:
A screenshot of the admin view is not published yet: the configuration screen is only reachable from an organization-admin account on the team tier, which does not exist during Early Access. The fields and options an admin gets are listed in full below.
Configuring it
As an organization admin: SSO in settings → add a configuration. AODex supports both common shapes, and which fields you fill depends on which your provider uses.
OIDC:
| Field | Notes |
|---|---|
| Issuer URL | Your provider’s issuer. |
| Client ID | From the application you register with the provider. |
| Client Secret | Likewise. Treat it as a credential. |
SAML:
| Field | Notes |
|---|---|
| IdP Entity ID | Your identity provider’s entity identifier. |
| IdP SSO URL | Where AODex sends people to authenticate. |
| IdP Certificate (PEM) | The signing certificate, PEM-encoded. |
Options
| Option | Effect |
|---|---|
| Allow users to sign in via this SSO | Whether the configuration is live. Switch it off to disable SSO without deleting the setup. |
| Auto-provision users | Create accounts for new users on first SSO login. |
Auto-provisioning means anyone your IdP will authenticate gets an account. That is usually what you want, and it is only safe if the application on the provider side is scoped to the right group. Scope it there, not here.
Edit SSO Configuration changes any of it later.
Signing in with it
Continue with SSO on the sign-in screen. People who have used it before are sent straight to your provider.
If SSO is unavailable, an existing password or Google sign-in still works — configuring SSO does not by itself remove the other routes in.