From dacddc995bb1913fdbbe82b22220d039f6596f81 Mon Sep 17 00:00:00 2001 From: miryamgduque Date: Mon, 17 Aug 2026 15:36:18 +0100 Subject: [PATCH] :books: Document identity provider configuration for SSO --- .../account-teams/enterprise-plan.njk | 43 ++++++++++++++----- 1 file changed, 33 insertions(+), 10 deletions(-) diff --git a/docs/user-guide/account-teams/enterprise-plan.njk b/docs/user-guide/account-teams/enterprise-plan.njk index 34e1867c08..18e227836a 100644 --- a/docs/user-guide/account-teams/enterprise-plan.njk +++ b/docs/user-guide/account-teams/enterprise-plan.njk @@ -144,17 +144,18 @@ desc: Learn how the Enterprise plan works in Penpot. Discover its features and h # -

Single Sign-On lets you require all members of your organization to authenticate through your corporate identity provider (IdP) before accessing any of the organization's teams and files. Once SSO is active, anyone who is removed from your directory automatically loses access to the organization's teams, without you having to manage it manually in Penpot.

+

Single Sign-On lets you require all members of your organization to authenticate through your corporate identity provider (IdP) before accessing any of the organization's teams and files.

SSO applies to teams and files only. The Admin Console is always accessible without SSO, so you can always reach your configuration to adjust or deactivate it, even if your own directory entry changes.

-

Supported identity providers

-

You can configure SSO with any of the following:

- -

Clicking the Activate SSO button runs a test connection against your IdP. If the connection fails, your draft is kept and no changes are applied.

+

Configuring your identity provider

+

Before setting up SSO in Penpot, you need to register Penpot as an application in your identity provider. The steps vary by provider, but you will always need to set the following callback URL in your IdP configuration:

+

https://<your-penpot-domain>/api/auth/oidc/callback

+

Your IdP will then give you a Client ID and Client Secret to use in Penpot. Once you have those:

+
    +
  1. Open the Admin Console.
    2. +
  2. Select SSO Config.
    3. +
  3. Choose your provider and fill in the fields.
    4. +
@@ -162,7 +163,29 @@ desc: Learn how the Enterprise plan works in Penpot. Discover its features and h
-

If the test passes, members who are not in your directory will lose access to the organization's teams the moment SSO is activated. Once confirmed, SSO becomes active immediately.

+
Generic authentication (OpenID Connect)
+

Use this option for any identity provider that supports the OIDC protocol, such as Okta, Keycloak, or Auth0.

+ + +
Azure Active Directory (OpenID Connect)
+ + +
Google (OAuth)
+ + +

When all fields are filled, click Activate SSO. Penpot will run a test connection against your IdP. If the connection fails, your draft is kept and no changes are applied.

+

If the test passes, a confirmation dialog will appear. It will warn you that members not in your directory will lose access to the organization's teams once SSO is active. Review your member list if needed, then confirm. SSO becomes active immediately.

What happens to existing sessions

When SSO is activated, any member who is currently inside one of the organization's teams is cut off immediately and sent through the SSO login. This does not log them out of Penpot entirely. They can still reach teams that do not belong to your organization without re-authenticating.