Single Sign-On

With single sign-on (SSO), members of your organization can sign in to Autify Genesis through your company identity provider. Configure an OIDC or SAML 2.0 provider once, and Genesis directs users with a matching email domain to it on sign-in.

Prerequisites

• To manage SSO providers, you need the organization Admin or Owner role.

• Prepare the email domain to configure and an identity provider that supports OIDC or SAML 2.0.

Adding an SSO provider

1. Open Settings from the account menu in the lower-left corner, and click Organization > Single Sign-On in the left sidebar.

2. Click Set up SSO.

   

   Set up SSO dialog
3. In Provider type, select OIDC or SAML.

4. In Email domain, enter the email domain of users to sign in through SSO (for example: sso.example.com).

5. In Issuer URL, enter the issuer URL of the identity provider (for example: https://acme.okta.com). OIDC endpoints are auto-discovered.

6. Enter the following fields depending on the provider type.

   Provider type	Fields
   OIDC	Client ID, Client secret
   SAML	Entry point URL (the IdP's SAML SSO endpoint), X.509 certificate (public certificate used to verify SAML assertions)

7. Click Set up SSO.

8. On the registered provider, click Get verification record.

9. Add the displayed DNS TXT record name and value to your domain's DNS settings.

10. After the DNS change propagates, click Verify domain. SSO sign-in stays unavailable until verification finishes.

After registration, copy the Redirect URI (add this to your IdP) shown on the screen and add it to the allowed redirect URLs on the identity provider side. Click the copy icon to copy it to the clipboard.

Reviewing registered SSO providers

The Single Sign-On page shows the type of each registered provider (OIDC / SAML), the email domain, the issuer URL, the redirect URI that must be registered with the IdP, and whether domain ownership has been verified. Until verification finishes, SSO sign-in remains unavailable for that provider.

Removing an SSO provider

1. Open the Single Sign-On page.

2. Click Remove SSO on the registered provider.

3. Click Delete in the confirmation dialog.

After an SSO provider is removed, users who signed in through that provider need to sign in with email and password.

Troubleshooting

Situation	Cause	Resolution
"Client ID is required for OIDC providers."	Client ID is missing for an OIDC provider.	Enter the client ID.
"Client secret is required for OIDC providers."	Client secret is missing for an OIDC provider.	Enter the client secret.
"Entry point URL is required for SAML providers."	Entry point URL is missing for a SAML provider.	Enter the SAML SSO endpoint URL of the IdP.
"X.509 certificate is required for SAML providers."	X.509 certificate is missing for a SAML provider.	Paste the public certificate of the IdP.
"Failed to register SSO provider."	The credentials entered were not accepted by the IdP.	Verify the issuer URL, client credentials, certificate, and other inputs.
"Domain ownership not verified" is shown.	The DNS TXT record has not been added yet, or DNS propagation is still in progress.	Click Get verification record, add the displayed TXT record to your domain, then wait and click Verify domain again.
"Could not verify domain ownership."	Genesis could not find the expected DNS TXT record yet.	Confirm the TXT record name and value, wait for DNS propagation, and retry Verify domain.

Further reading

• Security