# SSO

> Configure per-organization enterprise single sign-on with OIDC so members sign in through your identity provider.

*[View this page in the Flax docs](https://flax-analytics.com/docs/administration/sso)*

Flax ships with in-house email-and-password authentication and supports per-organization enterprise single sign-on (SSO) over OpenID Connect (OIDC). Configuring SSO is admin-only, under `/app/settings/security`.

## In-house authentication

By default, members sign in with an email and password managed by Flax. Passwords follow a length policy and sign-in timing is equalized to resist enumeration. See [Security](/docs/administration/security). SSO layers on top of this per organization — you do not have to replace built-in auth to use it.

## Configuring OIDC

An admin registers your identity provider by supplying:

| Field | Purpose |
| --- | --- |
| `issuerUrl` | Your OIDC provider's issuer URL, used to discover endpoints. |
| `clientId` | The client ID for the Flax application in your IdP. |
| `clientSecret` | The client secret. Write-only — leaving it blank keeps the stored value. |
| `domains` | The email domains routed to this connection. |
| `enforceSSO` | When enabled, members on these domains must sign in via SSO. |

After saving, use the built-in **test** action to validate the configuration before enforcing it.

## Domain routing and provisioning

When a user starts sign-in, Flax resolves their email domain to the matching SSO connection and redirects them to your IdP. On the callback it verifies the response and then:

1. Reuses an existing linked account, or
2. Links a user whose verified email domain belongs to this connection, or
3. Just-in-time (JIT) provisions a new SSO-only account (no password).

> [!IMPORTANT]
> Enabling `enforceSSO` for a domain requires those members to sign in through your IdP. Confirm the configuration with the test action first so you don't lock users out.

## Related

- [Security](/docs/administration/security)
- [Members and invitations](/docs/administration/members-and-invitations)
- [Audit log](/docs/administration/audit-log)