> For the complete documentation index, see [llms.txt](https://engyon.gitbook.io/engyon/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://engyon.gitbook.io/engyon/en/admin/organisation/setting-up-single-sign-on.md).
# Setting up Single Sign-On (SSO)
Setting up single sign-on via Options → Organisation, with login domains and an identity provider.
By default, users log in to Engyon using an email address and a password (and a one-time password because MFA is enforced in this case). However, it is possible to allow users to log in using *single sign-on* (SSO). In that case, users log in to an identity provider (IdP) and gain access to Engyon this way.
You need the Admin role at the audit firm. See [Organisation](/engyon/en/admin/organisation.md).
To configure SSO, it is necessary to navigate to Options within Engyon. Within the options, there is an Organisation screen. The left column holds the organisation settings.
## Login domains
Before SSO can be configured, the domains of the organisation must first be defined (in many cases, this is a single domain). These are the email domains used by users of the organisation to log in. For example, if the organisation's users log in with `firstname.lastname@engyon.io`, then `engyon.io` must be entered as a domain.
1. Go to Options → Organisation.
2. In the left column, find the heading login domains.
3. Click the plus icon (:plus:) to add a domain and click the checkmark icon (:check:) to save the domain.
The defined domains are used before logging in to determine which login options a user has.
{% hint style="info" %}
A domain can only be used for one organisation within Engyon.
{% endhint %}
## Adding an identity provider
Once the domains are defined, a single sign-on (or identity) provider can be added under the heading single sign-on by pressing the plus icon (:plus:) next to the heading. This opens a screen where the desired protocol can be selected. Engyon supports **OpenID Connect** and **SAML 2.0** as protocols.
Click on the desired protocol. A screen opens where the configuration details can be entered. For OpenID Connect, fill in Client ID and Client secret. The application settings show the sign-in redirect URI, the sign-out redirect URI, and the initiate login URI for the identity provider. This configuration requires details from the identity provider, but also generates data that the identity provider needs. It is therefore recommended to configure the SSO provider within Engyon simultaneously with the application within the identity provider.
When defining the identity provider, the domains that apply to this specific identity provider can be selected (only domains defined for the organisation can be chosen). This way, Engyon supports multiple domains that may lead to different tenants at the IdP. A domain can be used for multiple identity providers (a user logging in with that domain will then get multiple options to log in). An identity provider can have multiple domains that point to that specific identity provider.
Click Create at the bottom to save the configuration. The configuration is now shown under the heading single sign-on. The details of the configuration can be viewed by clicking the information icon (:circle-info:) next to the name of the configuration. Here, the configuration can also be deleted.
If a user now tries to log in with, for example, `firstname.lastname@engyon.io` as the email address, this person sees Email & password and the identity provider. The user selects one and logs in that way.
## Disabling password login
As soon as the functioning of SSO has been established, logging in via email address and password can be disabled. This can be done in the Organisation screen by switching off the toggle under allow password login.
If a user now tries to log in with, for example, `firstname.lastname@engyon.io` as the email address, this person will no longer see login options. The user is now automatically redirected to the identity provider to log in there.
{% hint style="info" %}
If a user logs in via SSO, MFA is not requested by the application and the user therefore does not need to enter a one-time password after logging in.
{% endhint %}
{% hint style="info" %}
Automatically creating users via SCIM is located under remaining, as soon as SSO exists. See [Inviting fellow auditors](/engyon/en/admin/organisation/inviting-auditors.md).
{% endhint %}