GoProject

Administration

Single sign-on

OpenID Connect, Microsoft and Google sign-in, and creating accounts by e-mail domain.

Where

Administration, Security, Single sign-on. Each provider adds a Continue with ... button to the sign-in screen while it is switched on. SAML is not supported; use OpenID Connect.

OpenID Connect

For Keycloak, Okta, Authentik, ADFS 2016 or newer, or any other OpenID Connect provider.

  1. In the provider, create a confidential OpenID Connect client (authorization code flow)
  2. Allow the redirect URI shown on the panel
  3. Enter the button name, the issuer (the address before /.well-known/openid-configuration, for Keycloak like https://sso.example.com/realms/company), the client ID and the client secret
  4. Optionally list the allowed e-mail domains
  5. Switch it on; switching on checks that the provider answers

The provider must be reachable over HTTPS.

Microsoft

For your organisation's Microsoft 365 (Entra ID) accounts. Only your own tenant is let in.

  1. In Microsoft Entra admin center, App registrations, register an application for accounts in this organisational directory only
  2. Add a Web platform with the redirect URI shown on the panel
  3. Create a client secret under Certificates and secrets
  4. Enter the Directory (tenant) ID, the Application (client) ID and the secret, and optionally the allowed e-mail domains

Google

Google sign-in uses the installation's Google client, set up under Administration, Integrations, Google Drive. Add the return address shown on the panel to the client's authorised redirect URIs. Optionally list allowed Google Workspace domains: with domains named, only accounts of those Workspaces get in, and a personal Google account with the same address is not enough. Google accepts only an https address with a domain name.

Who may sign in

By default the person must already have an account with the same e-mail address, and an address that Google or the OpenID Connect provider reports as unverified is not accepted.

Automatic account creation changes that. With Create accounts at the first sign-in switched on, add a rule per e-mail domain: which provider it applies to (OpenID Connect, Microsoft, Google), whether the new account is an Employee or a Help Desk customer, and optionally a group the person also joins. A domain without a rule gets no account.