Single Sign-On (SSO)
Single Sign-On lets your team sign in to laiout with your company's identity provider (such as Okta, Microsoft Entra, or Google), so there is no separate password to manage.
Getting Started
What is Single Sign-On in laiout?
Single Sign-On lets your team sign in to laiout using your company's identity provider, for example Okta, Microsoft Entra, or Google, with no separate password needed.
What do I need to set up SSO?
You need Admin or Manager access to your organisation in laiout, admin access to your identity provider (or help from your IT team), and about 10 minutes.
Where do I find the SSO settings?
Open your organisation in laiout, click your organisation's avatar in the left sidebar to open the organisation panel, then at the bottom click your user menu and choose Single Sign On (SSO).
Creating the App in Your Identity Provider
How do I create a laiout app in my identity provider?
In your identity provider, create a new app for laiout, then follow the section below that matches the protocol you will use (SAML or OIDC). The values you need are also shown at the top of the SSO window in laiout. laiout matches people by their email address, so the app must include the user's email when they sign in, and sign-ins without one are rejected. Once created, assign the app to the people who should have access to laiout.
What values do I use for a SAML identity provider?
Create the app with these values:
ACS / Reply URL
https://laiout.app/api/oauth/saml
Audience / Entity ID
https://saml.laiout.co
Then add an attribute so the app sends the user's email. Your identity provider may call this an attribute statement, an attribute mapping, or a claim:
The user's email address
Setting the app's Name ID format to EmailAddress works instead, if that is easier. Optionally, add firstName and lastName attributes as well.
What values do I use for an OpenID Connect (OIDC) identity provider?
Create the app with these values:
Redirect URL
https://laiout.app/api/oauth/oidc
The app must be a confidential Web app and must return the standard email claim.
Connecting SSO in laiout
How do I connect SSO once the app is created?
Back in the laiout SSO window, enter your company's email domain or domains under Email domains (for example acme.com), pressing Enter after each one. Then choose your protocol, SAML or OIDC. For SAML, paste the complete metadata XML from the app you just created. For OIDC, enter the Issuer URL, Client ID, and Client Secret from your app. Finally, click Enable SSO. SSO is active immediately.
My SAML metadata is being rejected. What's wrong?
Paste the complete metadata file, starting with the declaration on the first line. Metadata without it is rejected.
How do I test that SSO is working?
Go to the laiout login page and click Single Sign On, enter your work email, and click Proceed. You are sent to your company's sign-in page, and back into laiout once you have signed in.
Managing SSO
Can I require my team to sign in with SSO?
Yes. Once SSO is working, you can turn on Require SSO on Login in the same window. Team members must then sign in through SSO instead of a password. Organisation admins and managers keep password access as a backup.
Does SSO give people access to my organisation?
No. SSO handles sign-in, not access. Team members still need to be invited to your laiout organisation before they can log in.
Can I have more than one SSO connection per organisation?
No. There is one SSO connection per organisation, and saving again replaces the previous setup.
How do I edit my SSO setup without re-entering everything?
Your client secret and metadata are stored securely and never shown again. Leave those fields blank when editing to keep the current values.
Last updated