Overview
Let your team sign in to a connected app through Iden, without a separate password.
This section covers Iden acting as the identity provider for one of your connected apps: your team signs in to that app through Iden, instead of using a separate username and password for it.
Looking for the other direction? If you want your team to sign in to Iden itself using your company's own identity provider (such as Okta or Google Workspace), see SAML Single Sign-On in Organization Settings instead. This section is for using Iden as your identity provider.
How it works
For a connected app that supports it, you can turn on SSO so that logging in to that app is handled through Iden. Two protocols are supported: SAML and OIDC. Which one to use depends on what the app itself supports, check the app's own SSO or SAML/OIDC documentation to find out.
Where to configure it
Go to Connected Apps, click on the app, open the Settings tab, and find the SSO section.
Options common to both protocols
- Require MFA for login: when enabled, anyone without MFA enabled in Iden cannot sign in to the app through SSO.
- Launch URL: the address the Go to app button takes your team to. Optional for SAML, since Iden can fall back to its own generated login address if left blank. Required for OIDC, since there is no equivalent fallback, enter the app's own login page URL.
- Signing key algorithm: RSA or ECDSA. Determines the type of key Iden uses to sign what it sends the app, for either protocol.