Skip to main content

Single Sign-On

Connect your identity provider so your team signs in with the credentials they already use, and optionally joins your organization automatically based on their email domain.

Observatory supports two connection types: OIDC and SAML. You can have more than one connection, useful if different teams use different providers.

Setting up an OIDC connection​

  1. 1
    Add a connection
    Go to Organization settings → SSO, click Add Connection, and choose OIDC.
  2. 2
    Enter your provider's details
    Discovery URL, client ID, and client secret from your identity provider.
  3. 3
    Add and verify your domain
    Add the domain your team's emails use, then add the DNS TXT record shown to verify you own it.
  4. 4
    Finish the connection in your provider
    Copy the callback URL shown into your identity provider's app configuration.
  5. 5
    Turn on auto-membership (optional)
    If enabled, anyone who signs in with a verified domain and successfully authenticates joins your organization automatically, no invite needed.

Setting up a SAML connection​

The flow is the same, but you'll provide your identity provider's sign-in and sign-out URLs, upload its X.509 certificate, and set the user ID attribute and protocol binding (redirect or POST) instead of a discovery URL/client secret. You can also require signed requests if your provider expects them.

Provisioning members automatically​

Once a connection exists, open its Provisioning settings to enable SCIM and have members and their roles managed directly from your identity provider. See SCIM Provisioning.