Single sign-on

Let your team sign in to Studio with your OIDC identity provider, such as Okta or Azure AD, and map its groups to roles.

Single sign-on (SSO) lets people sign in to Studio with the account your company already manages, through an OpenID Connect (OIDC) identity provider such as Okta, Azure AD or Google. You can add new people automatically when they first sign in, give them roles from their identity provider groups and require SSO for your email domains.

Who can use this: the workspace Owner, on the Enterprise plan. Nobody else can view or change single sign-on. A connection made on Enterprise stays editable if the plan changes, but a new connection, or a new issuer or client ID, needs Enterprise. To move to Enterprise, see Billing.

Before you start

In your identity provider, create an OIDC web application for Studio:

  1. Set the sign-in redirect URI to https://www.sirv.studio/api/auth/sso/callback.
  2. Allow the openid, email and profile scopes.
  3. If you want to map groups to roles, add a groups claim to the ID token. In Okta and Azure AD the claim is usually groups. In Google, use a custom claim.
  4. Copy the issuer URL, the client ID and the client secret.

The issuer URL must publish an OpenID configuration at /.well-known/openid-configuration.

Connect your identity provider

  1. Go to Settings > Single sign-on.
  2. Click Set up single sign-on.
  3. Under Identity provider, fill in:
    • Display name: the name your team sees, for example your company name.
    • Issuer URL: the sign-in provider URL.
    • Client ID and Client secret from your identity provider.
    • Allowed email domains: the domains that can use this connection, separated by commas, for example company.com, subsidiary.com. You can add up to 10.
  4. Click Test connection. Studio checks the issuer before you save and shows Connection successful.
  5. Click Save.

To change the client secret later, type the new one. Leave the field blank to keep the current secret.

Set the sign-in rules

Under Sign-in rules:

  • Auto-provision users: Studio creates an account and adds the person to the workspace the first time they sign in with SSO.
  • Default Role for New Users: the role a new person gets when no group mapping matches. You can change roles later on Settings > Team.
  • Groups claim: the name of the claim in the ID token that lists the person's groups.
  • Group to role mapping: click + Add mapping, type the IdP group name and pick a role. Add one row for each group.

When a person is in more than one mapped group, the role with the most permissions wins. Studio checks the groups and updates the role each time the person signs in.

Click Save to keep the rules.

Require single sign-on

Once single sign-on works, you can stop people on your domains from signing in another way.

  1. Turn on Require single sign-on.
  2. Read the warning and click Require it.
  3. Click Save.

People with the allowed email domains must then sign in with single sign-on. The Owner is exempt, so you cannot lock yourself out. Test the connection first, or your team cannot sign in.

Sign in with SSO

Your team signs in from the normal sign-in page:

  1. Click Sign in with SSO.
  2. Type the Work email and click Continue.
  3. Sign in with the identity provider.

If the domain has no connection, the page says No SSO configured for this domain. If the email domain is not in Allowed email domains, sign-in fails with a message that the domain is not authorised for this connection.

Remove single sign-on

  1. Go to Settings > Single sign-on.
  2. Under Danger zone, next to Remove single sign-on, click Disconnect.
  3. Confirm with Disconnect.

Your team goes back to signing in with email and password, Google or GitHub. If your plan is no longer Enterprise, you cannot connect again unless you move back to Enterprise.