Sign your staff in with single sign-on

Connect your SAML 2.0 or OpenID Connect provider so your staff sign in with the account they already use.

Single sign-on lets your staff sign in to Taktyl with your organisation's own sign-in system, such as Microsoft Entra ID, Okta, Google Workspace, Shibboleth or ADFS. It works with any provider that speaks SAML 2.0 or OpenID Connect, and it is on every plan.

Each provider is supported, not yet verified: we have tested the protocols, and we are still checking each provider's setup screens with real accounts.

Before you start

Your provider may only sign people in for email domains we have approved for your organisation, so one organisation's sign-in system can never speak for another's people. Go to Organisation › Integrations, open Single sign-on, then Open single sign-on, and press Ask us to approve yours under Email domains. The feedback box opens with the request already started: add your domains and send it.

Set up your provider

On the Single sign-on screen, choose the Protocol: SAML 2.0 or OpenID Connect.
Give it a Name of your sign-in system, such as University Sign-On. It is shown on the sign-in button.
For SAML, paste your provider's Identity provider entity ID, its Sign-in address and its Signing certificate. For OpenID Connect, paste its Issuer, Client ID and Client secret. The secret is stored encrypted and never shown again.
Press Save. Single sign-on stays switched off until you switch it on.

Under Give these to your identity provider you find the addresses your provider asks for: the entity ID, the reply address (ACS URL) and the metadata address for SAML, or the redirect address for OpenID Connect. They are there from the moment you open the screen, and they do not change when you save.

Test it, then switch it on

Press Test sign-in. You go to your provider and come back, and Taktyl tells you who your provider signed in. Nobody is signed in and nothing is made. When it works, switch Single sign-on on.

How your staff sign in

On the sign-in page they type their email address and press Single sign-on (or Sign in with and your name for it). They do not need a password. You can also put the Sign-in link for your staff on your intranet: it goes straight to your provider.

The first time somebody signs in, Taktyl makes their account as an Organisation Member, unless you invited them: then the role and workspaces you chose apply. You give any other role from Members.
Somebody who is already staff here signs in as themselves, with the role they have.
Single sign-on is for staff. A student keeps opening activities from their course or the activity's link.
Single sign-on counts as the second factor for that sign-in, so make sure your provider asks for multi-factor authentication.
Signing out of Taktyl does not sign you out of your organisation's sign-in system.

Provider notes

Microsoft Entra ID: make an Enterprise application (non-gallery) for SAML, or an App registration for OpenID Connect. Entra ID often leaves out the "email verified" claim: Taktyl accepts the address when it is on one of your approved domains.
Okta: make an app integration with SAML 2.0 or OpenID Connect and paste our addresses into it.
Google Workspace: make an OpenID Connect client in Google Cloud for your Workspace, or a custom SAML app.

Certificates

A SAML signing certificate expires. Fourteen days before it does, Taktyl tells your organisation admins, the Integrations row in the rail shows a count, and the screen warns. Paste your provider's new certificate into Next certificate before your provider switches: an answer signed by either certificate is accepted, so nobody is locked out during the change.