> ## Documentation Index
> Fetch the complete documentation index at: https://docs.borghq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up single sign-on

> Connect a SAML 2.0 or OIDC identity provider, test it, and manage the connection

Owners and Admins set up single sign-on from **Organisation Settings → Single Sign-On**. Other members see the connection's status only. Before you start, [verify your domain](/platform/organisation-settings#verified-domains) with a DNS TXT record.

## Values for your identity provider

The card shows the values your IdP needs. Each field has a copy button.

| Protocol | Field in Odin | What to enter in your IdP |
| - | - | - |
| SAML | **ACS (Single Sign-On) URL** | Single sign-on URL, Reply URL or ACS URL, and the recipient and destination where asked |
| SAML | **SP Entity ID / Audience** | Audience URI, Identifier or SP entity ID |
| OIDC | **Redirect URL** | Sign-in redirect URI or Allowed callback URL |

### Required SAML claims

| Claim | Value | Required |
| - | - | - |
| **NameID** | The person's email address, format `EmailAddress` | Recommended |
| `email` | The person's email address | **Yes** |
| `firstName` | Given name | Optional; used for the person's name |
| `lastName` | Family name | Optional; used for the person's name |

The `email` attribute is what Odin uses to identify the person. Its domain must be one of the connection's verified domains.

### OIDC requirements

Odin uses the authorisation code flow with the `openid email profile` scopes. Your IdP must return an `email` claim. If it also returns `email_verified`, the value must be `true`.

## Connect the identity provider

<Steps>
  <Step title="Create the application in your IdP">
    Use the values above. The [identity provider guides](/platform/sso/identity-providers) have exact steps for Okta, Auth0, JumpCloud and Keycloak.
  </Step>

  <Step title="Choose SAML or OIDC in Odin">
    * **SAML**: paste the **IdP metadata URL**, or paste the full metadata XML under **…or paste metadata XML**.
    * **OIDC**: enter the **OIDC discovery URL** (ending `/.well-known/openid-configuration`), **Client ID** and **Client secret**.
  </Step>

  <Step title="Name it and pick domains">
    Add a **Display name** such as `Okta` (optional). Tick each verified domain whose users should sign in through this connection.
  </Step>

  <Step title="Save">
    Select **Connect identity provider**. The card shows the connection with its type, status and sign-in domains.
  </Step>

  <Step title="Test it">
    In a private browser window, sign in with an assigned account as described in [Logging in](/getting-started/logging-in#sign-in-with-single-sign-on). Test as an **Owner or Admin** if you plan to [require SSO](/platform/sso/mandatory-sso).
  </Step>
</Steps>

<Note>
  Metadata and discovery URLs must be public `https://` addresses. Odin refuses private, internal or `http://` addresses. If your IdP is not reachable from the internet, paste the SAML metadata XML instead.
</Note>

## Managing the connection

| Action | What happens |
| - | - |
| **Disable** / **Enable** | Pauses SSO without losing the configuration. Disabled connections are not offered at sign-in, and IdP sign-ins are refused. |
| **Reconfigure** | Change the IdP, metadata, credentials or domains. Saving a different IdP **replaces** the old one, so the old IdP can no longer sign anyone in. |
| **Remove** (bin icon) | Deletes the connection. People fall back to one-time codes, passkeys, Google or GitHub. |

While [mandatory SSO](/platform/sso/mandatory-sso) is on, **Disable**, **Reconfigure** and **Remove** are locked so you cannot lock your team out. Turn mandatory SSO off first.

Reconfiguring or disabling also clears the recent owner or admin SSO test. Test again before you turn mandatory SSO back on.

## Signing out and single logout

Odin always ends the Odin session **before** contacting your IdP, so a failed or refused IdP logout never leaves anyone signed in to Odin.

| Provider | SAML single logout |
| - | - |
| Okta | Supported. See [Okta single logout](/platform/sso/identity-providers#single-logout). |
| Microsoft Entra ID | Entra signs the person out. Leave the app's **Logout Url** empty. See [Entra signing out](/platform/sso/identity-providers#microsoft-entra-id). |
| Auth0, Keycloak | Not supported yet. Leave single logout off in the IdP. |
| JumpCloud | Not offered by JumpCloud. |
| OIDC (any provider) | Not used. The IdP session stays. |

If the IdP has no single logout endpoint, Odin signs the person out of Odin only.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.