Single sign-on

Single sign-on (SSO) lets people sign in to your organisation with your identity provider, such as Microsoft Entra ID, Okta or Google Workspace, instead of a Backed password. Backed supports two protocols: SAML 2.0 and OpenID Connect. Set it up under Settings > Profile and terms, on the SSO tab.

Before you start

You need to be an Administrator with the Can access Organisation settings permission. Anyone else sees Administrators only. You also need access to your identity provider, to create an application there for Backed.

Where SSO stands

The badge beside the SSO heading shows its state:

Disabled — SSO is off.
Enabled — SSO is on, but your identity provider isn't set up yet.
Configured — your identity provider is saved.
Verified — someone has signed in with SSO since the last change, with the date.

Saving a change returns SSO to Configured. Sign in with SSO again to verify it.

Choose the protocol and turn SSO on

Go to Settings > Profile and terms and open the SSO tab.
Under Protocol, choose how your identity provider signs people in: SAML 2.0 or OpenID Connect. Use the one your identity provider's application is set up for.
Select Enable SSO.

The page then shows the panels for the protocol you chose.

Change the protocol

The protocol can be changed only while SSO is disabled. While it is on, the choice is locked and says Disable SSO to change the protocol.

Disable SSO (see below).
Under Protocol, choose the other protocol. If the current protocol has identity provider settings saved, confirm with Switch protocol; otherwise the choice is saved straight away.
Select Enable SSO again. The panels for the new protocol appear.

Switching removes the other protocol's identity provider settings, and they can't be recovered. User settings, SSO-only mode and Default Permissions are kept.

Set up SAML 2.0

With SAML 2.0 chosen, the page shows:

Backed service provider details. Copy the ACS URL into your identity provider's SAML application, or select Download service provider metadata and upload that file there.
Identity provider. Enter the Identifier/Entity ID your identity provider uses, and upload its Identity provider metadata XML (1 MB or smaller). Select Save. The panel then shows the identity provider and its signing certificate with its expiry date. A certificate that Expires within 30 days or has Expired needs a new metadata file.
SAML - User settings. Enter the Email attribute, First name attribute and Last name attribute your identity provider sends, and select Save.

Set up OpenID Connect

With OpenID Connect chosen, the OpenID Connect provider panel asks for:

Identity provider: Microsoft Entra ID, Okta, Google Workspace or Another OpenID Connect provider. Choosing one fills in its usual issuer and scopes; you can change them before saving.
Issuer URL. Replace the placeholder in the address, including its braces, with your own value. Google Workspace always uses the same issuer, so it can't be changed.
Client ID and Client secret, from your identity provider's application. Backed stores the secret encrypted and never shows it again: once saved, the field says Stored — enter a new secret to replace it. Leave it empty to keep the stored secret.
Scopes, separated by spaces. openid is required; include email so Backed receives an email address.
Redirect URI. Copy it and register it as a redirect URI in your identity provider's application.

Select Save. Backed checks the issuer against your identity provider's published details before it saves.

The OpenID Connect - User settings panel holds only the switch for creating accounts (below): OpenID Connect always sends the email address and names in the same fields, so there are no attributes to map.

Test an OpenID Connect connection

Test connection checks your identity provider end to end without changing anyone's sign-in. It is available once the provider is saved with SSO enabled; until then it says Save the provider with SSO enabled before testing it.

Select Test connection. Backed sends you to your identity provider to sign in.
When you come back, the Connection test panel shows the result:
- The connection works. Your identity provider sent these details., with a table of each Claim and its Value: Issuer, Subject, Email, Email verified, Name, Given name and Family name. A claim your identity provider didn't send says Not sent.
- The connection test failed., with the reason, for example The ID token was issued for a different client ID. or Your identity provider didn't send an email address. Include the email scope.
- The test hasn't finished. Run Test connection again.

Create accounts for new people

Create an Administrator account when an unknown user signs in with SSO lets someone without a Backed account in your organisation sign in with SSO and get an Administrator account. Someone who already has a Backed account with the same email address is added to your organisation.

Default Permissions sets the permissions those accounts are given. Changing them doesn't affect existing accounts. You need the Can edit Permissions permission to change them.

Require SSO with SSO-only mode

SSO-only mode makes SSO the only way in for the people it covers. Passwords, email links, mobile sign-in and invitation links stop working for them. (It was called SAML-only mode before OpenID Connect was added.)

Under Who must use SSO, choose Owners, administrators and assessors or Everyone.
Turn on Require SSO.
Confirm with Require SSO.

From their next sign-in, the people it covers must use SSO. Anyone already signed in stays signed in until their session ends.

Require SSO is unavailable until SSO is configured (Finish configuring SSO first.) and until you have signed in with SSO yourself (Sign in with SSO yourself before you require it.), so you can't lock yourself out.

Removing someone at your identity provider stops their new sign-ins. A session that is already open ends within 8 hours.

Disable SSO

Select Disable SSO. While SSO-only mode is on, it says Turn off SSO-only mode before disabling SSO.
Confirm with Disable SSO.

The SSO button disappears from sign-in and everyone signed in with SSO is signed out. Your configuration is kept.

If someone else changes the settings

If another Administrator saves a change while you are editing, the page says These settings changed. Select Try again to reload the latest settings, then make your change again.

On the sign-in page, people select Sign in with single sign-on and, if asked, enter your organisation's web address. Backed sends them to your identity provider and back.