How to set up single sign-on (SAML or OIDC)
Dieser Artikel ist noch nicht übersetzt und wird auf Englisch angezeigt.
Connect Okta, Microsoft Entra ID, Google Workspace or any SAML or OIDC identity provider, verify your email domain, and optionally require SSO for everyone.
Single sign-on lets your team sign in to Kendor through your company's identity provider. You set it up in three steps under Settings → Security: connect the identity provider, verify your email domain, then, once a test sign-in works, decide whether to require it.
Before you start
- Your organization is on the Enterprise plan, which includes single sign-on.
- You're an Owner in Kendor.
- You can add an app in your identity provider, and add a TXT record to your domain's DNS.
1. Connect your identity provider
In Kendor, open Settings → Security and pick the protocol your identity provider uses.
SAML (Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud…)
- In your identity provider, create a new SAML app for Kendor and enter the values Kendor shows:
| In your identity provider | Value from Kendor |
|---|---|
| ACS URL / Reply URL / Single sign-on URL | ACS URL |
| Entity ID / Audience URI / Identifier | Entity ID |
Some identity providers can read these from Kendor's metadata URL instead.
2. Map the user's email address to the email attribute (most identity providers send it as the Name ID by default), and first and last name if you can.
3. Assign the people or groups who should use Kendor to the app.
4. Copy the app's metadata URL, or download its metadata XML, and paste it into Kendor. Choose Save identity provider.
OIDC
- In your identity provider, create a web application with the Redirect URL Kendor shows.
- Paste the app's discovery URL (it ends in
/.well-known/openid-configuration), client ID and client secret into Kendor, then choose Save identity provider.
2. Verify your email domain
Kendor sends people to your identity provider based on their email domain, so it needs proof the domain is yours.
- Enter your domain, for example
acme.com, and choose Save domain. - At your DNS provider, add a TXT record on that domain with the value Kendor shows (it starts with
kendor-verification=). - Choose Verify domain. DNS changes can take a few minutes; try again if it isn't found yet.
A domain can belong to one Kendor organization only. Public email domains such as gmail.com can't be claimed.
3. Test it, then decide whether to require it
Sign in once through SSO: choose Test SSO sign-in (shown when your own email is on the domain), or ask a teammate to choose Sign in with SSO on the sign-in page and enter their work email.
- People on your domain who are new to Kendor join your organization as Viewers the first time they sign in. Change their role under Members & roles.
- Existing members keep their role.
After the first successful sign-in you can turn on SSO only. From then on, people with an email on your domain can't sign in with a password or with Google: the sign-in page sends them to your identity provider. Turn it off again at any time.
Remove single sign-on
Choose Remove single sign-on at the bottom of the page. Your team signs in with passwords or Google again. People who only ever used SSO have no Kendor password; they can set one with Forgot password? on the sign-in page.
Troubleshooting
| Message on the sign-in page | What to check |
|---|---|
| Single sign-on isn't set up for this email's domain. | The domain isn't verified yet, or the email is on a different domain. |
| The sign-in through your company didn't go through. | Start again from Kendor's sign-in page. Signing in from the identity provider's app dashboard isn't supported yet. |
| Your company's sign-in returned an email outside its verified domain. | The identity provider sent a different email than the one on your domain. Check the app's email attribute mapping. |
| Your team has no free seats. | Your plan's member limit is reached. Free a seat or ask us to raise it. |