> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orriven.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> Members sign in with the company identity provider — OpenID Connect or SAML 2.0 — routed by a verified email domain. Everyone SSO brings in starts as a Viewer.

Enterprise single sign-on lets people sign in with their company account instead of a password held on orriven. The organization registers its identity provider (IdP) against an **email domain**. Anyone whose work address ends in that domain is sent to the provider at sign-in and, on success, lands in the organization as a member. **Single sign-on** lives in the organization section of the console, beside Members and Roles. It decides who can get in, not what any Business Unit contains.

Both **OpenID Connect** and **SAML 2.0** are supported.

## Register an identity provider

Registering a provider needs an organization **Owner** or **Admin**: a provider decides who can become a member, which is the same class of authority as inviting people.

<Steps>
  <Step title="Add identity provider">
    Choose **Add identity provider**. Pick the **Protocol** and enter the **Email domain** (for example `bigcorp.com`). One provider covers exactly one domain.
  </Step>

  <Step title="Enter what the IdP administrator provides">
    * **OpenID Connect** — the **Issuer URL**, **Client ID**, and **Client secret**. Endpoints are discovered from the issuer; nothing else has to be retyped.
    * **SAML 2.0** — the **Sign-on URL**, and optionally the **IdP metadata XML**. The IdP administrator in turn needs the **SAML metadata** address, shown at the bottom of the page once a SAML provider exists — append the provider's domain as `providerId`.
  </Step>

  <Step title="Verify the domain">
    The new row shows **Domain unverified**. Choose **Get DNS record**: the page shows a **TXT** record — host is the domain, value is a token. Publish it in the domain's DNS, then choose **Verify domain**. On success the row shows **Enabled**.
  </Step>
</Steps>

<Warning>
  Until the domain verifies, the provider exists but **cannot sign anyone in**. Verification proves that the organization controls the domain. Without it, anyone could claim a domain and intercept its logins.
</Warning>

## How members sign in

On the sign-in page, below the password form, is **Sign in with your company account**. The person enters their work email. If its domain has an enabled provider, they are sent there and come back signed in. If not, the page says the domain has no single sign-on configured and offers the way back to password sign-in.

Nobody needs to be created or invited beforehand. The first successful sign-in through a provider **makes the person a member** of the organization that registered it, with the **Viewer** role.

## What SSO decides — and what it does not

* **The IdP proves who someone is. It does not decide how much authority they hold.** Everyone arriving through SSO joins as **Viewer**. Raising them is the organization's decision, made on [Members & roles](/en/organization/members-roles) — as an organization role, or per Business Unit.
* **Deactivating a person at the IdP stops their SSO sign-in.** Their membership on orriven stays until it is removed on **Members**. There is no automatic deprovisioning.
* **Password sign-in stays available.** SSO cannot be made mandatory for an organization.
* **Sign-in always starts on orriven's page.** Sign-in started from the IdP's own portal is not supported.
* **Attendees are not affected.** Attendees never sign in; they reach their own pages through the links the platform emails them. See [Hosted pages](/en/events/hosted-pages).

## Rules to know

* **One provider, one domain.** A group with five email domains registers five providers. An organization can register up to ten.
* **Unverified means inert.** A provider whose domain has not been verified is listed, but no one can sign in through it.
* **Removing a provider removes only the sign-in route.** Choose **Remove** on its row. People who joined through it stay members until removed on Members.
* **Owner or Admin only** — for adding, verifying, and removing providers alike.

## Related

<CardGroup cols={2}>
  <Card title="Members & roles" icon="users" href="/en/organization/members-roles">
    Where SSO-provisioned Viewers are raised to the role they need.
  </Card>

  <Card title="Roles" icon="shield-check" href="/en/organization/roles">
    What a Viewer — and every other role — may do.
  </Card>
</CardGroup>