Single sign-on

NoCert supports OpenID Connect. SAML is not supported.

Single sign-on is a Business feature, and an owner sets it up in Settings → SSO.

Connect your provider

Verify the email domain your members sign in with, under Domains, before you start. The form asks for it as the SSO domain and refuses a domain that is not verified.

Register NoCert as an application in your identity provider, then paste what it gives you: the issuer URL, the client ID and the client secret. NoCert reads the provider’s discovery document to find the rest. All four fields are required, the SSO domain included, and every sign-in checks that the address your provider returns is on that domain.

Your provider needs the redirect URI that the SSO screen shows you. Copy it from there rather than typing it, since it has to match exactly.

Tell NoCert which claim carries group membership. Providers disagree here: some send groups, others need the claim added to the token explicitly. If the claim is missing at sign-in, the user is refused with a message saying so, which is the signal to fix it on the provider side.

Map groups to roles

The role of a member your provider creates comes from their groups, recalculated at every sign-in. You map each group to viewer, operator or owner.

Someone in several mapped groups gets the highest role among them.

Someone whose groups match nothing is refused. There is no default role and no implicit access, so adding a group mapping is what grants access, and removing one takes it away at the next sign-in.

Mappings govern the members your provider created, and nobody else. Someone you added yourself in Settings → Local Users signs in through the provider all the same, keeps the role you gave them, and is not refused for matching no group.

A member provisioned by your provider does not count against your local account allowance.

Enforcing SSO

Enforcing single sign-on closes password and email-code sign-in for members whose email domain is your SSO domain. Members on any other domain keep theirs, as do the recovery accounts you allow-list.

NoCert refuses to enforce it if that would leave the organization with no way back. At least one owner keeps a local sign-in anchor, which is what stops a misconfigured provider from locking everybody out.

You also have to be signed in through your own provider to turn enforcement on, so a full round trip is proved rather than promised. Changing the connection afterwards turns enforcement back off, and you enable it again once the new connection works.

What a Pro organization sees

The SSO tab is visible and explains that the feature needs Business.

Single sign-on is live during the trial, since the trial is a Business trial. If you set it up during the trial and then take a Pro plan, it stops, and the members your provider created can no longer sign in at all: they have no local credential and never can. Disabling SSO, which stays available on any plan, gives password sign-in back to the accounts you created yourself, not to theirs.