Single sign-on (SSO)
Your members sign in with their company account (Microsoft Entra ID, Okta, Google Workspace, Keycloak…) through OpenID Connect. Set up by an owner; an administrator reads the settings, turns single sign-on off and removes a domain. Included in the Enterprise offer.
Proving your domains
Add each email domain of your company (example.com), then publish the TXT record shown in the DNS of that domain and click “Check”. A DNS change can take up to 48 hours. Public mailbox domains (gmail.com…) are refused, and a domain is proved by one Vigilo organization only. Removing the last verified domain turns SSO off.
Fields and buttons
- Add the domain
- An email domain of your company (example.com). Public mail providers (gmail.com…) are refused, and a domain is proven by one organization only.
- Check
- Looks for the TXT record shown in the domain's DNS. A DNS change can take up to 48 hours: try again later.
- To verify
- The TXT record has not been found yet: the addresses of this domain do not go through SSO yet.
- Remove
- The addresses of this domain no longer go through SSO; removing the last verified domain turns SSO off.
Connecting your identity provider
In your provider, register Vigilo as a web application and declare the redirect URI shown on the screen. Then copy the issuer address, the client ID and the client secret. Saving reads the provider's configuration: a wrong address is refused at once. The secret is stored encrypted and never shown again; leave the field empty to keep it.
Fields and buttons
- Redirect URI
- To declare at your provider, in the web application created for Vigilo; “Copy” copies it without typos.
- Issuer
- The issuer address given by your provider; Vigilo reads its configuration when saving and refuses a wrong address.
- Client ID
- The identifier of the application created for Vigilo at your provider.
- Client secret
- Stored encrypted, never shown again; leave empty to keep the current one. Enter the new one when your provider expires it.
Options, required SSO and diagnosis
“Single sign-on on” shows “Continue with SSO” on the sign-in page for addresses on your verified domains. “Create accounts at first sign-in” gives an unknown address the Viewer role on every site; an invited address joins with the invited role and scope, even when this option is off. An existing account that is not a member of your organization is never taken over. “Require single sign-on” closes the other ways in for your members on these domains and their current sessions; owners keep their password, link and passkey as a backup. Two-factor authentication is handled by your identity provider. The “Sign-ins” card shows the last SSO sign-in and the reason of the last refusal; every refusal is also in the Journal.
Fields and buttons
- Single sign-on on
- “Continue with SSO” appears at sign-in for the addresses of your verified domains; the other ways to sign in stay open.
- Create accounts at first sign-in
- An unknown address of a verified domain joins with the “Viewer” role on all sites. Off: only members and invitees sign in.
- Require single sign-on
- Your members on these domains sign in only through your provider; their other sessions are closed. An “Owner” keeps their other ways, as a fallback.
- Sign-ins
- The last SSO sign-in and, for the last refusal, its reason and the provider's answer. Each refusal is also written to the audit log.