Single sign-on

Single sign-on lets your members sign in to Folioso through your own OpenID Connect identity provider, such as Google Workspace, Microsoft Entra ID or Okta.

Before you start#

• Single sign-on is available if your plan includes it. See the pricing page.
• Only organisation admins can set it up.
• Folioso supports OpenID Connect (OIDC). SAML isn't supported.
• Your provider must say that each member's email address is verified. Folioso refuses a sign-in without that.

How it works#

Single sign-on works alongside password sign-in and never replaces it. Members who prefer their password, or who sign in with GitHub, can carry on doing so. A misconfigured provider can't lock anybody out.

Single sign-on only signs in people who are already members of your organisation. It doesn't create accounts. Invite people first, as usual. See Members and invitations.

The first time a member signs in through your provider, Folioso links their provider identity to their Folioso account by email address. Both must be verified:

• the provider must confirm the email address is verified;
• the member's Folioso account must already have a confirmed email address. If it doesn't, they're asked to sign in with their password once to confirm it.

After that first sign-in, the link stays in place even if their email address changes later.

Setting it up#

1. Open Settings and go to Single sign-on.
2. In your identity provider, create an OpenID Connect web application. Give it the redirect URI shown in Folioso under "Give your provider this redirect URI". Copy it exactly.
3. Back in Folioso, fill in:
   • Issuer URL: exactly as your provider publishes it, for example https://accounts.google.com. It must start with https://. Folioso reads the provider's discovery document from there.
   • Client ID: from your provider.
   • Client secret: from your provider.
4. Leave Allow members to sign in with single sign-on unticked for now, and click Save single sign-on.
5. When you're ready, tick Allow members to sign in with single sign-on and click Save single sign-on again.

Folioso asks your provider for the openid, email and profile scopes.

After saving, the secret is stored and never shown again. The field reads "Stored — leave blank to keep it". Type a new secret only when you want to replace it.

How members sign in#

Share the address shown under "Members sign in from" with your members. Opening it takes them straight to your provider.

Or, on the Folioso sign-in page:

1. Click Single sign-on.
2. Type the Workspace address: the first part of your organisation's web address.
3. Click Continue and sign in at the provider.

After signing in at the provider, they land in your organisation. Signing in through single sign-on doesn't ask for a Folioso two-factor code.

Single sign-on checks membership every time. Someone you've removed from the organisation can't sign in through it, even if your provider still recognises them.

When sign-in fails#

The sign-in page explains what went wrong. Common causes:

• "No [organisation] account uses that address": the person isn't a Folioso user with that email address. Invite them first.
• "That address has not been confirmed on this account yet": they need to sign in with their password once to confirm their email address.
• "That account is no longer a member of [organisation]": they have a Folioso account but aren't a member of your organisation, for example because they've been removed.
• "Single sign-on is not available for that workspace": it's switched off, not set up, or your plan doesn't include it.

Turning it off#

Untick Allow members to sign in with single sign-on and click Save single sign-on. Members sign in with their password or GitHub instead. If your plan stops including single sign-on, it stops working until you upgrade.

Every change to the single sign-on settings is recorded in the audit log.