Single Sign-On lets you require all members of your organization to authenticate through your corporate identity provider (IdP) before accessing any of the organization's teams and files. Once SSO is active, anyone who is removed from your directory automatically loses access to the organization's teams, without you having to manage it manually in Penpot.
+Single Sign-On lets you require all members of your organization to authenticate through your corporate identity provider (IdP) before accessing any of the organization's teams and files.
SSO applies to teams and files only. The Admin Console is always accessible without SSO, so you can always reach your configuration to adjust or deactivate it, even if your own directory entry changes.
-You can configure SSO with any of the following:
-Clicking the Activate SSO button runs a test connection against your IdP. If the connection fails, your draft is kept and no changes are applied.
+Before setting up SSO in Penpot, you need to register Penpot as an application in your identity provider. The steps vary by provider, but you will always need to set the following callback URL in your IdP configuration:
+https://<your-penpot-domain>/api/auth/oidc/callback
Your IdP will then give you a Client ID and Client Secret to use in Penpot. Once you have those:
+If the test passes, members who are not in your directory will lose access to the organization's teams the moment SSO is activated. Once confirmed, SSO becomes active immediately.
+Use this option for any identity provider that supports the OIDC protocol, such as Okta, Keycloak, or Auth0.
+https://login.microsoftonline.com/<your-tenant-id>/v2.0/When all fields are filled, click Activate SSO. Penpot will run a test connection against your IdP. If the connection fails, your draft is kept and no changes are applied.
+If the test passes, a confirmation dialog will appear. It will warn you that members not in your directory will lose access to the organization's teams once SSO is active. Review your member list if needed, then confirm. SSO becomes active immediately.
When SSO is activated, any member who is currently inside one of the organization's teams is cut off immediately and sent through the SSO login. This does not log them out of Penpot entirely. They can still reach teams that do not belong to your organization without re-authenticating.