# Single sign-on

> Okta, Microsoft Entra ID, Google Workspace or any OIDC or SAML 2.0 provider, with verified domains, roles and enforcement.

People from your company sign in to opsen through your identity provider and get the role you choose. Owners from GitHub keep owner rights. With single sign-on required, everyone, owners included, signs in through the provider at least every twelve hours. Single sign-on is included on every plan.

## Set it up

**Settings → Single sign-on.** Only owners see this section.

### OpenID Connect (Okta, Entra ID, Google Workspace, Auth0, Keycloak, Ping)

1. In your provider, create a web application with the redirect URI shown in settings: `https://opsen.dev/sso/oidc/callback`. Grant the `openid`, `email` and `profile` scopes.
2. In opsen, choose **OpenID Connect** and enter the issuer URL, client ID and client secret:

| Provider | Issuer URL |
| --- | --- |
| Okta | `https://YOUR-ORG.okta.com` (or your custom authorization server) |
| Microsoft Entra ID | `https://login.microsoftonline.com/TENANT-ID/v2.0` |
| Google Workspace | `https://accounts.google.com` |
| Auth0 | `https://YOUR-TENANT.auth0.com/` |

opsen reads the provider's discovery document, signs people in with the authorization code flow and PKCE, and checks every ID token's signature, issuer, audience, expiry and nonce. The client secret is stored encrypted.

### SAML 2.0 (Okta, Entra ID, OneLogin, JumpCloud, ADFS, Ping)

1. In your provider, create a SAML application with the **ACS URL** and **entity ID** shown in settings, or import opsen's service-provider metadata from the link there. Set the NameID format to email, and sign the response or the assertion (SHA-256).
2. In opsen, choose **SAML 2.0** and paste the provider's metadata XML, or its entity ID, sign-in URL and signing certificate.

opsen verifies the signature against your certificate and reads only the signed element. It checks the issuer, audience, recipient, the request it answers and the validity window. Turn off assertion encryption for opsen: encrypted assertions are refused.

## Verify your domains

List the email domains your provider covers. For each, add the TXT record shown in settings on `_opsen.yourdomain.com`, then press **Check**. Only people on verified domains can sign in through single sign-on, and only verified domains route from the sign-in page, so no one can claim your domain with their own provider.

## Test, then require it

Press **Test sign-in** and sign in through your provider. Once a test passes and you have signed in through it yourself, **Require for everyone** becomes available, so nobody is locked out by a misconfiguration. To stop requiring it, press the same button again.

## Roles

| Role | Can |
| --- | --- |
| Owner | Everything, including single sign-on, roles and billing. Comes from GitHub, re-checked at every sign-in and at least hourly |
| Admin | Approve changes, connect platforms, change prices and budgets |
| Viewer | Read every page, export CSV and open the audit log. Cannot change anything |

People who sign in through your provider get the role set in single sign-on settings. Change or remove anyone in **Settings → People with access**, and export the access list for access reviews.

## Signing in

People go to [opsen.dev/sso](https://opsen.dev/sso), or press **Continue with single sign-on** on the sign-in page, and enter their work email.