Single sign-on (SSO)

Your members sign in with their company account (Microsoft Entra ID, Okta, Google Workspace, Keycloak…) through OpenID Connect. Set up by an owner; an administrator reads the settings, turns single sign-on off and removes a domain.

Proving your domains

Add each email domain of your company (example.com), then publish the TXT record shown in the DNS of that domain and click “Check”. A DNS change can take up to 48 hours. Public mailbox domains (gmail.com…) are refused, and a domain is proved by one Vigilo organization only. Removing the last verified domain turns SSO off.

Fields and buttons

Add the domain: An email domain of your company (example.com). Public mail providers (gmail.com…) are refused, and a domain is proven by one organization only.
Check: Looks for the TXT record shown in the domain's DNS. A DNS change can take up to 48 hours: try again later.
To verify: The TXT record has not been found yet: the addresses of this domain do not go through SSO yet.
Remove: The addresses of this domain no longer go through SSO; removing the last verified domain turns SSO off.

Connecting your identity provider

In your provider, register Vigilo as a web application and declare the redirect URI shown on the screen. Then copy the issuer address, the client ID and the client secret. Saving reads the provider's configuration: a wrong address is refused at once. The secret is stored encrypted and never shown again; leave the field empty to keep it.

Fields and buttons

Redirect URI: To declare at your provider, in the web application created for Vigilo; “Copy” copies it without typos.
Issuer: The issuer address given by your provider; Vigilo reads its configuration when saving and refuses a wrong address.
Client ID: The identifier of the application created for Vigilo at your provider.
Client secret: Stored encrypted, never shown again; leave empty to keep the current one. Enter the new one when your provider expires it.

Options, required SSO and diagnosis

“Single sign-on on” shows “Continue with SSO” on the sign-in page for addresses on your verified domains. “Create accounts at first sign-in” gives an unknown address the Viewer role on every site; an invited address joins with the invited role and scope, even when this option is off. An existing account that is not a member of your organization is never taken over. “Require single sign-on” closes the other ways in for your members on these domains and their current sessions; owners keep their password, link and passkey as a backup. Two-factor authentication is handled by your identity provider. The “Sign-ins” card shows the last SSO sign-in and the reason of the last refusal; every refusal is also in the Journal.

Fields and buttons

Single sign-on on: “Continue with SSO” appears at sign-in for the addresses of your verified domains; the other ways to sign in stay open.
Create accounts at first sign-in: An unknown address of a verified domain joins with the “Viewer” role on all sites. Off: only members and invitees sign in.
Require single sign-on: Your members on these domains sign in only through your provider; their other sessions are closed. An “Owner” keeps their other ways, as a fallback.
Sign-ins: The last SSO sign-in and, for the last refusal, its reason and the provider's answer. Each refusal is also written to the audit log.