Single sign-on

With single sign-on (SSO), people sign in with their organization’s account instead of a separate password. sc-cms supports one OpenID Connect provider: Google Workspace, Microsoft Entra ID, Okta, Auth0, Keycloak, and most others. SAML isn’t supported directly.

Setting it up

SSO is set up on the server, not in the admin.

1. In your provider, create an OpenID Connect app (a “web application”). Register this redirect address: https://<your site>/admin/sso/callback.
2. Give whoever runs the server the details, to set as environment variables:

Setting
OIDC_ISSUER	The provider’s address, such as https://accounts.google.com.
OIDC_CLIENT_ID, OIDC_CLIENT_SECRET	From the app you created.
OIDC_LABEL	The button text, such as Sign in with Google (default Sign in with SSO).
OIDC_PROVISION_ROLE	Optional: create accounts automatically with this role (such as author).
OIDC_ALLOWED_DOMAINS	Optional, with the above: only for these email domains, such as example.com.

After a restart, the sign-in page shows the SSO button.

Who can sign in

People are matched by their verified email address:

• People who already have an account sign straight in. Invited people become active.
• Suspended people are turned away.
• People with no account are turned away (Ask an administrator to invite you), unless OIDC_PROVISION_ROLE is set. Then an account with that one role is created, if their email domain is allowed.

Roles are managed in sc-cms, not taken from the provider’s groups.

Good to know

• Password sign-in stays available, so administrators can still get in if the provider is down.
• Signing out of the provider doesn’t sign people out of sc-cms. To remove someone’s access, suspend them under People & Access.
• Every SSO sign-in and refusal is recorded in the activity log.