> For the complete documentation index, see [llms.txt](https://help.laiout.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.laiout.co/organisation-settings/single-sign-on.md).

# Single Sign-On (SSO)

Single Sign-On lets your team sign in to laiout with your company's identity provider (such as Okta, Microsoft Entra, or Google), so there is no separate password to manage.

## Getting Started

<details>

<summary>What is Single Sign-On in laiout?</summary>

Single Sign-On lets your team sign in to laiout using your company's identity provider, for example Okta, Microsoft Entra, or Google, with no separate password needed.

</details>

<details>

<summary>What do I need to set up SSO?</summary>

You need Admin or Manager access to your organisation in laiout, admin access to your identity provider (or help from your IT team), and about 10 minutes.

</details>

<details>

<summary>Where do I find the SSO settings?</summary>

Open your organisation in laiout, click your organisation's avatar in the left sidebar to open the organisation panel, then at the bottom click your user menu and choose Single Sign On (SSO).

</details>

## Creating the App in Your Identity Provider

<details>

<summary>How do I create a laiout app in my identity provider?</summary>

In your identity provider, create a new app for laiout, then follow the section below that matches the protocol you will use (SAML or OIDC). The values you need are also shown at the top of the SSO window in laiout. laiout matches people by their email address, so the app must include the user's email when they sign in, and sign-ins without one are rejected. Once created, assign the app to the people who should have access to laiout.

</details>

<details>

<summary>What values do I use for a SAML identity provider?</summary>

Create the app with these values:

| Your IdP asks for    | Value                               |
| -------------------- | ----------------------------------- |
| ACS / Reply URL      | <https://laiout.app/api/oauth/saml> |
| Audience / Entity ID | <https://saml.laiout.co>            |

Then add an attribute so the app sends the user's email. Your identity provider may call this an attribute statement, an attribute mapping, or a claim:

| Attribute name | Value                    |
| -------------- | ------------------------ |
| email          | The user's email address |

Setting the app's Name ID format to EmailAddress works instead, if that is easier. Optionally, add firstName and lastName attributes as well.

</details>

<details>

<summary>What values do I use for an OpenID Connect (OIDC) identity provider?</summary>

Create the app with these values:

| Your IdP asks for | Value                               |
| ----------------- | ----------------------------------- |
| Redirect URL      | <https://laiout.app/api/oauth/oidc> |

The app must be a confidential Web app and must return the standard email claim.

</details>

## Connecting SSO in laiout

<details>

<summary>How do I connect SSO once the app is created?</summary>

Back in the laiout SSO window, enter your company's email domain or domains under Email domains (for example acme.com), pressing Enter after each one. Then choose your protocol, SAML or OIDC. For SAML, paste the complete metadata XML from the app you just created. For OIDC, enter the Issuer URL, Client ID, and Client Secret from your app. Finally, click Enable SSO. SSO is active immediately.

</details>

<details>

<summary>My SAML metadata is being rejected. What's wrong?</summary>

Paste the complete metadata file, starting with the declaration on the first line. Metadata without it is rejected.

</details>

<details>

<summary>How do I test that SSO is working?</summary>

Go to the laiout login page and click Single Sign On, enter your work email, and click Proceed. You are sent to your company's sign-in page, and back into laiout once you have signed in.

</details>

## Managing SSO

<details>

<summary>Can I require my team to sign in with SSO?</summary>

Yes. Once SSO is working, you can turn on Require SSO on Login in the same window. Team members must then sign in through SSO instead of a password. Organisation admins and managers keep password access as a backup.

</details>

<details>

<summary>Does SSO give people access to my organisation?</summary>

No. SSO handles sign-in, not access. Team members still need to be invited to your laiout organisation before they can log in.

</details>

<details>

<summary>Can I have more than one SSO connection per organisation?</summary>

No. There is one SSO connection per organisation, and saving again replaces the previous setup.

</details>

<details>

<summary>How do I edit my SSO setup without re-entering everything?</summary>

Your client secret and metadata are stored securely and never shown again. Leave those fields blank when editing to keep the current values.

</details>

<details>

<summary>What happens if I remove the SSO connection?</summary>

Removing the connection turns SSO off immediately, and password login continues to work.

</details>

<details>

<summary>Who do I contact for help setting up SSO?</summary>

Contact the laiout team at <support@laiout.co> and we are happy to help you get set up.

</details>