Skip to main content
Owners and Admins set up single sign-on from Organisation Settings → Single Sign-On. Other members see the connection’s status only. Before you start, verify your domain with a DNS TXT record.

​
Values for your identity provider

The card shows the values your IdP needs. Each field has a copy button.

​
Required SAML claims

The email attribute is what Odin uses to identify the person. Its domain must be one of the connection’s verified domains.

​
OIDC requirements

Odin uses the authorisation code flow with the openid email profile scopes. Your IdP must return an email claim. If it also returns email_verified, the value must be true.

​
Connect the identity provider

1

Create the application in your IdP

Use the values above. The identity provider guides have exact steps for Okta, Auth0, JumpCloud and Keycloak.
2

Choose SAML or OIDC in Odin

  • SAML: paste the IdP metadata URL, or paste the full metadata XML under …or paste metadata XML.
  • OIDC: enter the OIDC discovery URL (ending /.well-known/openid-configuration), Client ID and Client secret.
3

Name it and pick domains

Add a Display name such as Okta (optional). Tick each verified domain whose users should sign in through this connection.
4

Save

Select Connect identity provider. The card shows the connection with its type, status and sign-in domains.
5

Test it

In a private browser window, sign in with an assigned account as described in Logging in. Test as an Owner or Admin if you plan to require SSO.
Metadata and discovery URLs must be public https:// addresses. Odin refuses private, internal or http:// addresses. If your IdP is not reachable from the internet, paste the SAML metadata XML instead.

​
Managing the connection

While mandatory SSO is on, Disable, Reconfigure and Remove are locked so you cannot lock your team out. Turn mandatory SSO off first. Reconfiguring or disabling also clears the recent owner or admin SSO test. Test again before you turn mandatory SSO back on.

​
Signing out and single logout

Odin always ends the Odin session before contacting your IdP, so a failed or refused IdP logout never leaves anyone signed in to Odin. If the IdP has no single logout endpoint, Odin signs the person out of Odin only.