Single sign-on

With single sign-on (SSO), everyone with an email address at your company’s domain signs in to Eddish through your identity provider: Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, Keycloak, or any other that speaks SAML 2.0 or OpenID Connect. People new to your account join it the first time they sign in, so there’s nobody to invite.

Single sign-on is an add-on to the paid plan, $4 a seat a month. If Single sign-on in Account Settings says it isn’t included, contact us to add it. Only the account’s Owner can set it up.

Set it up

Open Account Settings, then Single sign-on, under Integrations. The screen walks through four steps, and says what it’s waiting for.

1. Verify your domain

Add your email domain, such as example.com. The screen shows a TXT record to add to that domain’s DNS:

Type	Name	Value
TXT	_eddish-verification.example.com	eddish-domain-verification=…

Add it wherever your domain’s DNS is managed, then choose Verify. New records can take a few minutes to appear. Add each domain your people have addresses at.

Public email services such as gmail.com can’t be added, and a domain can be verified by only one account.

2. Connect your identity provider

Choose SAML 2.0 or OpenID Connect. In your identity provider, create an app for Eddish using the values the screen shows:

• SAML: the Entity ID (audience) and the Reply (ACS) URL, or point your provider at the Metadata URL. Then give Eddish your provider’s metadata URL, paste its metadata XML, or enter its entity ID, single sign-on URL and signing certificate. Send the person’s email address as the NameID or an email attribute; first and last name attributes are optional.
• OpenID Connect: register the Redirect URI, then give Eddish the issuer URL, client ID and client secret. The scopes used are openid email profile.

Also choose whether new people join as a Member or an Admin. You can change anyone’s role later in Members.

3. Run a test sign-in

Choose Run a test sign-in and sign in at your identity provider. It signs nobody in to Eddish: it checks the settings work, and that your provider sends an address at a verified domain. If it doesn’t work, the screen says why.

4. Turn it on

Choose Turn on. It can only be turned on after a test that passed since your last change.

What changes for people

• On the sign-in screen, anyone with an address at your domains is sent to your identity provider after entering their email.
• They can’t sign in with a password, Google or Microsoft any more, or reset a password.
• Your identity provider handles two-factor authentication. If someone set up Eddish’s own two-factor, they’re still asked for its code, and Require two-factor in Account security still applies.
• Someone who signs in for the first time joins your account, with a seat in each app that has one free.

Owners keep their password, and can choose Use a password instead on the sign-in screen. That way a problem with your identity provider can’t lock you out of your own account.

Making changes

Saving a change to your identity provider turns single sign-on off until a new test passes, because the change would apply at everyone’s next sign-in. Meanwhile people sign in the usual way; anyone without a password can use Forgot password.

Removing someone in your identity provider stops them signing in to Eddish. A session they already have lasts until it expires, so to cut someone off at once, also remove them from Members, or turn on automatic provisioning, which does that for you.

Automatic provisioning (SCIM)

With single sign-on, people join your account the first time they sign in. Automatic provisioning goes further: your identity provider adds people before they ever sign in, keeps their names up to date, and takes them out of the account when they leave or are unassigned from the app — their seats are freed straight away. It works with Okta, Microsoft Entra ID and other identity providers that support SCIM 2.0.

1. Under Automatic provisioning (SCIM), choose Make a token. Copy it now: it isn’t shown again.
2. In your identity provider’s Eddish app, turn on provisioning and enter the Tenant URL and the token.
3. Back in Eddish, choose Turn on.

Good to know:

• People must have an address at one of your verified domains.
• Your identity provider can’t change anyone’s sign-in address: it’s theirs in every Eddish account they belong to.
• Owners are never removed by provisioning. Manage Owners in Members.
• Make a new token replaces the old one at once, so update your identity provider straight after.

Roles from groups

If your identity provider sends groups (in Okta, Push Groups; in Entra ID, assign groups to the app), they appear under Groups. Choose a role for each group’s people:

• Someone in any group set to Admin is an Admin.
• Otherwise, someone in a group set to Member is a Member.
• Everyone else joins with the role in New people join as.

A group set to Doesn’t set a role changes nobody. Roles follow the groups as people join and leave them, so for someone in a group with a role, change their role in your identity provider rather than in Members. Owners never change this way.

Turning it off

Choose Turn off. Everyone signs in the usual way again. People who only ever signed in through single sign-on have no password yet: they can set one with Forgot password.