# Set up single sign-on

This guide is for Owners and Admins. At the end, people with your company email domain sign in through your identity provider, and new people join your organization when they do.

Passwords stay the default. Single sign-on is optional, and your identity provider keeps control of two-factor sign-in for these people.

## Before you start

- Single sign-on is a setting of a root organization. A child organization uses the provider of its root. A partner's customers are their own organizations and set up their own provider. See [Partners](/partners).
- It is off until GEKI allows it for your organization. If **Settings**, **Single sign-on** says it is not available, write to [support@geki.ai](mailto:support@geki.ai).
- You can create apps in your identity provider and add a DNS record for your email domain. Ask your IT team if you cannot.

## Open the setup

Open **Settings**, then **Single sign-on**. The setup has four steps: Provider, Domain, Test, and Activate. Nothing applies to other people before the last step.

## 1. Provider

Choose your provider. The page lists what to do at the provider and shows the redirect URI to copy. Register GEKI as an app there with this redirect URI.

- **Microsoft Entra ID.** Register an app, create a client secret, and add the optional claim `email` to the ID token. Enter the client ID, the secret, and the tenant ID.
- **Google Workspace.** Create an OAuth client of the type Web application and set the consent screen to Internal. Enter the client ID and the secret. The client of [Connect Google](/guides/connect-google) can serve both: add this redirect URI to it too.
- **OpenID Connect.** Create an app with the code flow and the scopes `openid`, `email`, and `profile`. Enter the client ID, the secret, and the https address of the issuer. The provider must publish a discovery document at `/.well-known/openid-configuration`.

Enter your email domain too, for example `example.com`. Free mail domains cannot be used. The provider can only sign in people whose email address ends with this domain.

The client secret is stored in the authentication service. The Console never shows it again. To change the issuer, the tenant, or the client ID later, enter the secret again.

SAML is not available.

## 2. Domain

Add the TXT record that the page shows to the DNS zone of your domain, then select **Check the record**. DNS changes can take a few minutes. Only a verified domain is sent to your identity provider. Nobody else can claim your domain.

## 3. Test

Select **Test sign-in** and sign in at your identity provider with your own work account. Use the same email address as your account in the Console. If the account already has a password, the sign-in links to it. GEKI confirms the test when you come back. Other people are not affected yet.

## 4. Activate

Select **Activate single sign-on**. From now on:

- A new person with your domain enters the email address on the sign-in page, is sent to your identity provider, and joins your organization as a Member.
- Your child organizations share the provider.
- A person who already has a password is not sent to the provider by themselves. They can keep using the password. After they enter their email, the password page also offers **Continue with** your provider. They sign in once through the provider and the account is linked, with all its memberships and roles. You can also send them the sign-in link that the page shows.

Roles are set in the Console. Appoint Admins and Builders under **Members**.

## Turn it off

Select **Deactivate** to send people back to their passwords. The setup stays, so you can activate it again. People who have no password set one with **Forgot password** on the sign-in page.

Select **Remove the setup** to delete the provider, its stored secret, and the routing of the domain. People keep their accounts.

## What GEKI does not do

- It does not turn passwords off. Blocking password sign-in for members is a later step.
- It does not copy groups or roles from your identity provider.
- It does not link an account when the domain is not verified.