Single sign-on
An organization can sign its people in through its own identity provider — Entra ID, Okta, Google Workspace, Keycloak, Authentik or any other — over OpenID Connect or SAML 2.0. This is separate from the Google, GitHub and Microsoft buttons anyone can use.
Before you start
Section titled “Before you start”- A verified domain. A connection can be enabled only with one, and only addresses on it are accepted from the provider.
- An admin of the organization. Creating, changing and deleting a connection ask you to confirm with a second factor.
- At most five connections per organization.
OpenID Connect
Section titled “OpenID Connect”Register an application in your provider with:
| Setting | Value |
|---|---|
| Redirect URI | https://api.infrality.io/api/auth/sso/callback |
| Grant | Authorization code, with PKCE |
| Scopes | openid email profile |
Then create the connection in Infrality with the provider’s issuer URL, the client ID and client secret. Infrality reads the provider’s discovery document before saving, so a wrong issuer is refused straight away. The secret is stored encrypted and never shown again.
Infrality accepts only asymmetrically signed ID tokens, from exactly the configured issuer, for its own client.
SAML 2.0
Section titled “SAML 2.0”Create the connection in Infrality first: it gives you the service provider’s values.
| Setting | Value |
|---|---|
| Entity ID / metadata URL | https://api.infrality.io/api/auth/sso/saml/<connection-id>/metadata |
| ACS (reply) URL | https://api.infrality.io/api/auth/sso/saml/<connection-id>/acs |
| NameID | A stable identifier for the person |
| Attribute | The person’s email address |
From the provider, give Infrality its entity ID, its sign-on URL (https) and its signing certificate (PEM).
The assertion must be signed. Sign-in starts from Infrality (service-provider initiated); a sign-in started from the provider’s portal is refused. Each response can be used once.
Settings on a connection
Section titled “Settings on a connection”| Setting | Meaning |
|---|---|
| Default role | Member or Viewer — what someone signing in for the first time joins as. Never an admin role. |
| Provider enforces MFA | Sessions through this connection count as MFA for this organization’s policy. Otherwise only an ID token saying mfa does. |
| Enabled | Offered at sign-in. |
Signing in
Section titled “Signing in”On the sign-in page, a person types their work address; if its domain is verified by an organization with enabled connections, they are sent to their provider. On their first sign-in they join the organization at the default role; an existing member keeps theirs.
An existing Infrality account with the same address is linked rather than duplicated.
Failures return to the sign-in page with a short reason; the details are in the server logs, never shown.
Requiring it
Section titled “Requiring it”Once a connection works, the organization can require single sign-on for everybody on its verified domains.