Single sign-on (Enterprise)

Artavolo Enterprise authenticates users against your identity provider with OpenID Connect. Users who sign in through the provider for the first time are created automatically and added to the workspace you choose.

Configuration lives under Administration → Settings → Single sign-on. Each provider needs:

Options: link existing accounts by verified e-mail, just-in-time provisioning (target workspace and role), enforce SSO (password login for administrators only), skip local 2FA for SSO users, map e-mail domains to providers.

Microsoft Entra ID

1. Entra admin center → App registrations → New registration. Redirect URI (Web): https://<your domain>/auth/sso/entra/callback.
2. Certificates & secrets → New client secret.
3. Discovery URL: https://login.microsoftonline.com/<tenant id>/v2.0/.well-known/openid-configuration.
4. Token configuration: add the email optional claim (ID token).

Keycloak

1. Clients → Create client, type OpenID Connect, client authentication on.
2. Valid redirect URI: https://<your domain>/auth/sso/keycloak/callback.
3. Discovery URL: https://<keycloak>/realms/<realm>/.well-known/openid-configuration.

Okta

1. Applications → Create App Integration → OIDC, Web Application.
2. Sign-in redirect URI: https://<your domain>/auth/sso/okta/callback.
3. Discovery URL: https://<your okta domain>/.well-known/openid-configuration.

SAML 2.0 and LDAP/Active Directory are available on request.