Skip to main content
Caronte
Docs

Admin guide · Organization

Authentication (SSO)

Choose how members of the organization sign in, at Admin → Authentication.

Sign-in methods

Email & password is on by default; enterprise SSO providers sit alongside it.

The Authentication page listing sign-in methods: email & password plus an OIDC SSO provider.
Authentication — email & password plus enterprise OIDC providers.

Add a provider with Add provider — Microsoft Entra, Google, Okta, Auth0, Keycloak, or any OIDC IdP. You supply the issuer, and register the redirect URI the page gives you with your IdP.

Rolling SSO out safely

The usual sequence: add the provider, verify a real login, then tighten.

  1. Add the OIDC provider and register the redirect URI.
  2. Have a user complete a real SSO login end-to-end.
  3. Optionally disable email & password.

warning · Disable password only after SSO works

Turning off email & password before a verified SSO login can lock people out of the organization.