# SSO Configuration

Source: https://docs.ops0.com/docs/settings/sso

ops0 supports Single Sign-On via **OIDC** and **SAML 2.0**. Connect your identity provider to centralize authentication, enforce corporate login policies, and auto-provision users without manual account creation.

---

## Supported Providers

| Provider | Protocol | Notes |
|----------|----------|-------|
| **Okta** | OIDC or SAML | Recommended for OIDC |
| **Azure Active Directory** | OIDC or SAML | Use OIDC for simpler setup |
| **Google Workspace** | OIDC | |
| **Auth0** | OIDC | |
| **OneLogin** | SAML | |
| **Any SAML 2.0 IdP** | SAML | Generic setup |

---

## Provider Setup

**OIDC Setup**

### OIDC Setup

### Navigate to SSO Settings
Go to **Settings** > **SSO** > **Add Provider** and select **OIDC**.

### Enter Provider Details
Fill in the following fields:

| Field | Description |
|-------|-------------|
| **Provider Name** | Display label shown on the login screen |
| **Client ID** | OAuth client ID from your IdP |
| **Client Secret** | OAuth client secret from your IdP |
| **Issuer URL** | e.g. `https://your-okta-domain.okta.com` |

ops0 automatically discovers endpoints (authorization, token, userinfo, JWKS) from the issuer URL using OpenID Connect Discovery.

### Configure the Redirect URI
In your identity provider, add the following as an allowed redirect URI:

```
https://app.ops0.ai/sso/callback
```

### Test and Save
Click **Test Connection** to verify the integration, then click **Save**.

**saml**

### SAML Setup

### Navigate to SSO Settings
Go to **Settings** > **SSO** > **Add Provider** and select **SAML**.

### Get Service Provider Metadata
Download the **ops0 SP metadata XML** or copy the individual values:

| Value | Description |
|-------|-------------|
| **ACS URL** | Assertion Consumer Service URL |
| **Entity ID** | ops0 service provider identifier |

### Create a SAML Application in Your IdP
In your identity provider, create a new SAML application and supply the ACS URL and Entity ID from the previous step.

### Supply IdP Metadata to ops0
Copy your IdP's **metadata URL** or paste the raw XML into ops0.

### Map Attribute Claims
Configure attribute mappings so ops0 can read user identity:

| SAML Attribute | ops0 Field |
|----------------|------------|
| `email` | Email address |
| `firstName` | First name |
| `lastName` | Last name |

### Test and Save
Click **Test Connection** to verify the SAML handshake, then click **Save**.

---

## Role Mapping

Map groups or attributes from your identity provider to ops0 roles. This runs at login time — users receive the mapped role automatically.

| IdP Group / Attribute | ops0 Role |
|-----------------------|-----------|
| `engineering-leads` | Admin |
| `developers` | Editor |
| `readonly-team` | Viewer |

Configure mappings in **Settings** > **SSO** > (select provider) > **Role Mappings**. If a user matches multiple groups, the highest-privilege role wins.

---

## Domain Restriction

Restrict SSO login to specific email domains so that only users from your organization can authenticate.

### Open Provider Settings
Go to **Settings** > **SSO** > (select provider) > **Domain Restrictions**.

### Add Allowed Domains
Enter one or more domains (e.g. `company.com`, `subsidiary.com`).

### Save
Users with email addresses outside the allowed domains will be denied login.

---

## Auto-Provisioning

When **Auto-Provisioning** is enabled, users who authenticate via SSO for the first time are automatically created in ops0 with the role determined by role mapping.

- **Auto-Provisioning On**: Users are created on first SSO login with the mapped role. No admin action required.

- **Auto-Provisioning Off**: Users must be pre-created in Settings > IAM before they can log in via SSO.

Toggle this setting in **Settings** > **SSO** > (select provider) > **Auto-Provisioning**.

---

## Multiple Providers

ops0 supports multiple SSO providers simultaneously. All configured providers appear on the login screen and users can choose which one to authenticate with.

This is useful for organizations with multiple identity providers (e.g. Okta for employees and Auth0 for contractors).

---

## Disabling SSO

Toggle the provider off in **Settings** > **SSO** to disable it. Users will fall back to email/password authentication. Existing sessions remain active until they expire.

**Locked Out?**

If you misconfigure SSO and can no longer log in, contact **support@ops0.ai** with your organization admin email. The support team can disable SSO and restore email/password access.

---

## Related

- [IAM & Roles](https://docs.ops0.com/docs/settings/iam): Manage users, roles, and permissions for your organization.

- [Organization Settings](https://docs.ops0.com/docs/settings/organization): Configure organization-level preferences and policies.