Skip to main content

Single sign-on (SSO)

On the Enterprise plan, an organization admin can connect your company's own identity provider — Okta, Microsoft Entra ID, or any OpenID Connect–compatible IdP — so members sign in to JobKred through it. Sign-in stays restricted to members your admin has already added, and removing a member (or disabling the connection) shuts off their access immediately.

Who is this for?

Setup is admin-only (Org settings → Single sign-on). If you're a member, all you need is the sign-in link your administrator shares — see Signing in with SSO.

What you need​

  • The Enterprise plan (the page is available to organization admins).
  • An identity provider that supports OpenID Connect with the authorization-code flow: Okta, Microsoft Entra ID, Auth0, Keycloak, PingOne, and most others qualify. SAML-only setups (including Google Workspace's custom-SAML apps) are not supported yet.
  • Permission to register an application in that IdP and copy its client credentials.

Setting it up (admins)​

1. Register JobKred at your identity provider​

Create an OIDC Web Application in your IdP's admin console. When it asks for a redirect (or callback / sign-in) URI, use the Callback URL shown at the top of Org settings → Single sign-on — it's there and copyable before you save anything.

Grant the application the standard openid, email, and profile scopes, and assign the people who should be able to sign in.

2. Save the connection​

Back in JobKred, fill in:

  • Display name — how the connection appears to your team (e.g. "Acme Okta").
  • Issuer URL — your IdP's OpenID Connect issuer, e.g. https://your-tenant.okta.com or https://login.microsoftonline.com/<tenant-id>/v2.0 (use your directory's tenant ID, not common).
  • Client ID and Client secret — from the application you just registered.

Saving validates the issuer against your IdP's published configuration; if something's off (a typo'd issuer, an endpoint we can't verify), you'll get a specific error and nothing is stored. The secret is encrypted at rest and never shown again — the field stays masked, and you only enter a new value to rotate it.

3. Test, activate, and do one real sign-in​

Click Test connection to verify discovery and signing keys, then Activate. Before sharing anything, open the Sign-in link yourself in a private window and complete a full sign-in — that end-to-end check is the one thing activation can't do for you.

SSO signs in existing members only — there's no automatic account creation. Add people under Org settings → Members → Add member using the same email address your IdP holds for them, then distribute the sign-in link (it also works as the app-tile target inside your IdP portal).

Signing in with SSO​

Open the sign-in link your administrator shared, authenticate at your organization's identity provider, and you'll land in JobKred. The first time, JobKred links your IdP account to your member account by email and sends you a confirmation notice — if you ever receive that email unexpectedly, contact your administrator.

If sign-in fails, the message is deliberately generic. The usual causes: you haven't been added as a member yet, your IdP email doesn't match the address your admin used, or the connection is disabled — your administrator can see the specifics.

Managing the connection​

  • Editing credentials moves the connection back to Draft (sign-in pauses) until you re-activate it. Changing the issuer or client ID also unlinks everyone's IdP accounts — members simply re-link automatically on their next sign-in.
  • Disable stops SSO sign-in immediately and signs out everyone who signed in through the connection. Re-activating restores it.
  • Delete removes the connection and everyone's IdP links. Members who never set a password can get back in with Forgot password or a fresh invitation.
  • Admins are notified by email whenever another admin creates, changes, activates, disables, or deletes the connection.
MFA

If your organization enforces multi-factor authentication at your identity provider, it applies to every SSO sign-in automatically. Platform-level MFA for password sign-ins is on our roadmap — see the Security page.

Troubleshooting​

SymptomLikely cause
"That sign-in link isn't active"Wrong or outdated link, connection in Draft/Disabled, or the plan no longer includes SSO. Check the status badge on the settings page.
"Ask your administrator to add you as a member"The IdP account authenticated fine, but no member matches — add the person (with the exact email the IdP asserts) under Members.
Sign-in succeeds at the IdP but bounces back to the login pageUsually a stale or expired attempt — use the sign-in link again from the start. If it persists, contact support.
Saving fails with an issuer or endpoint errorThe issuer URL must be https, publicly reachable, and match your IdP's published configuration exactly (including any trailing slash your IdP uses). Copy it from the IdP's own "issuer" field.