Single sign-on (SSO)

Before you start

SSO is set up with the owner account, from the "SSO" menu of your customer portal. The redirect URI to declare at your provider is shown there: it is the same for the web vault, the extension and the apps.

Microsoft Entra ID

1. In the Entra admin center, “App registrations” → “New registration”: accounts in this organizational directory only (single tenant), “Web” platform, redirect URI (shown in your customer portal).
2. Note the “Application (client) ID” and the “Directory (tenant) ID”: the issuer is https://login.microsoftonline.com/<directory ID>/v2.0 (never /common or /organizations).
3. “Certificates & secrets” → new client secret: copy the value (not the secret ID) and note its expiry date (24 months maximum).
4. Delegated Microsoft Graph permissions openid, email, profile, offline_access, User.Read with admin consent; add the optional “email” claim; turn on “Assignment required” to restrict access to a group. Every user needs an email address in their profile.

Google Workspace

1. In your organization's Google Cloud console, “APIs & Services” → “OAuth consent screen”: type “Internal” (restricted to accounts of your Workspace domain).
2. “Credentials” → “Create OAuth client ID” → “Web application”, authorized redirect URI (shown in your customer portal).
3. Copy the client ID and client secret. The issuer is https://accounts.google.com.
4. We automatically add the parameters needed to keep the session alive (access_type=offline, prompt=consent).

Keycloak

1. In your realm, create an OpenID Connect client with “Client authentication” on and the standard flow (authorization code); valid redirect URI (shown in your customer portal).
2. Require PKCE with the S256 method and set the access token lifespan to at least 10 minutes.
3. Copy the secret from the “Credentials” tab. The issuer is https://<your server>/realms/<realm>, identical to the “issuer” field of the OpenID configuration.
4. Only users whose email address is verified in Keycloak can sign in.

Enable SSO

1. In your customer portal, choose your provider, then enter the issuer, the client ID and the client secret.
2. Enter the secret's expiry date: we will warn you before it expires.
3. Tick "Enable SSO" and save. The status changes to "active" once the settings are applied to your vault.
4. Try a real sign-in with an admin account, in the web vault and in the extension.

The master password is still requested to unlock the vault: it is what decrypts your data, and your identity provider does not know it.

Make SSO mandatory

Once everyone has signed in with SSO at least once, turn on "Require SSO for all users". The setting applies to the whole vault: accounts with no identity at your provider will be blocked.

Renew the client secret

An expired secret blocks all SSO sign-ins. Before it expires, create a new secret at your provider and enter it in your customer portal. Leave the field empty to keep the current secret.

When an employee leaves

1. Disable their account at your identity provider.
2. In the admin console, remove them from the organisation.
3. This removal frees their seat and disables their account; their data is kept.
4. Change the shared passwords they had access to.