Guides

Single sign-on

On the hosted service's Business and Enterprise plans, a workspace can let its people sign in with your organization's identity provider: anything that speaks SAML 2.0 or OpenID Connect, such as Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud or Keycloak. Owners set it up from the workspace menu (Single sign-on). Self-hosted OpenRows signs in through your own Keycloak, where you add identity providers directly.

Set it up

1. Add OpenRows as an app at your identity provider. The settings page shows what to enter there:
   • OpenID Connect: the redirect URI. Give the app the authorization code grant and note its client ID and secret.
   • SAML 2.0: the entity ID (audience), the ACS URL (single sign-on URL) and the metadata URL. Send the email address as the NameID (emailAddress format) and the attributes email, firstName and lastName, and sign the response or the assertion.
2. Connect it in OpenRows. Pick the protocol and enter, for OpenID Connect, the issuer URL (OpenRows reads its discovery document), the client ID and the client secret; for SAML, the identity provider's entity ID, its SSO URL and its signing certificate. The secret is never shown again: leave the field empty to keep it.
3. Verify your email domains. Add each domain your people's addresses use, then add the TXT record the page shows at your DNS provider (name _openrows-verification.<domain>, value openrows-verification=…) and select Verify. DNS changes can take a while to show. A domain can belong to one workspace only.

How people sign in

On the sign-in page they choose Sign in with SSO and enter their work email. OpenRows finds your provider by the address's domain and sends them straight to it.

• Join on first sign-in. With this on (the default), someone whose address is on a verified domain joins the workspace the first time they sign in through your provider, with the role you choose (creator, editor, commenter or read only; never owner). On a plan with an editor limit, they don't join when no editor seat is left; invite them instead.
• Require single sign-on. With this on, addresses on your verified domains can't sign in with a password, Google or GitHub, only through your provider. The workspace's owners keep every way in, so a broken provider can't lock them out.
• Your provider can only sign in addresses on your verified domains. A sign-in through it with any other address is refused.

Audit log

On the Enterprise plan, the audit log records changes to single sign-on and its domains, people joining through it, and each sign-in with its method (sso through your provider).

Turn it off

Uncheck On to pause it, or Remove it to delete the provider and its domains. People who joined keep their membership; remove them on the Members page if needed.