Skip to main content

Single sign-on (SSO)

Configure OIDC-based single sign-on for your organisation​

Single sign-on (SSO) lets your team log in to Trust Platform Studio using your organisation's identity provider (IdP). Trust Platform Studio supports the OpenID Connect (OIDC) protocol.

Prerequisites​

Before you begin, you need:

  • An OIDC-compatible identity provider (e.g. Microsoft Entra ID, Okta, Google Workspace)
  • Permission to register a new application in your IdP
  • Editor or Developer role in your TrustPlatform organisation

Enable SSO​

  1. Log in to Trust Platform Studio at Loading....
  2. Go to Settings > Single sign-on (SSO).
  3. Select Enable SSO.
  4. In your IdP, register a new OIDC application and note the Discovery URL, Client ID, and Client secret.
  5. In the dialog, enter the Email domain (a single bare email domain, e.g. example.com), Discovery URL, Client ID, and Client secret, then select Next. Trust Platform contacts your IdP to verify the Discovery URL and derives the Callback URL from the issuer.
    note

    If Trust Platform cannot reach the Discovery URL (for example, if it is unreachable or returns an error), an inline error message will appear on this step. Verify the URL is correct and publicly accessible, then try again.

  6. On the confirmation screen, copy the Callback URL and paste it into your IdP's allowed redirect URIs.
  7. Return to the dialog in Trust Platform, check the confirmation checkbox, and select Activate SSO.

How domain matching works​

The email domain you register covers all subdomains automatically. For example, registering acme.com will route users with @acme.com and @team.acme.com addresses to SSO login.

Each domain can only be registered by one organisation. If a domain or any of its subdomains is already managed by another organisation's SSO provider, the registration will be rejected.

Callback URL​

The Callback URL is shown on the confirmation screen after Trust Platform verifies the Discovery URL. It is derived from your IdP's issuer and is unique to your SSO configuration. Copy it from the confirmation screen and paste it into your IdP's allowed redirect URIs before selecting Activate SSO. You can also view it at any time under View SSO configuration.

Update credentials​

If your IdP credentials or email domain change:

  1. Go to Settings > Single sign-on (SSO).
  2. Select View SSO configuration.
  3. Select Edit credentials.
  4. Click the masked Client ID or Client secret field to clear it and enter the new value. You can also update the Email domain or Discovery URL in this dialog if your IdP or organisation's domain has changed.
  5. Select Save credentials.

Disable SSO​

Disabling SSO signs out all team members who are currently logged in via SSO. For those users who never created a password because they only ever signed in with SSO, they will need to use the reset-password path to set up a password.

note

Team members who only ever signed in via SSO and have no password set will not be able to log in after SSO is disabled. They can regain access by using the Forgot password flow on the login page to set a new password.

  1. Go to Settings > Single sign-on (SSO).
  2. Select Disable.
  3. Check the confirmation checkbox and select Disable SSO.

Troubleshooting​

SSO login fails immediately​

  • Verify the Discovery URL ends in .well-known/openid-configuration and returns a valid JSON document when opened in a browser.
  • Check that the Callback URL is registered as an allowed redirect URI in your IdP.
  • Confirm the Client ID and Client secret match the values in your IdP application.

Team members are redirected to password login​

  • The user's email domain must match the domain registered for your SSO provider.
  • Ensure the IdP returns an email claim in the ID token.

Discovery URL or credentials did not work​

  • Test the discovery URL in a browser — it should return a JSON document.
  • Re-enter the Client ID and Client secret (click each masked field to clear and re-type).
  • Check your IdP application is active and not expired.

SSO was disabled but users can still log in via SSO​

Active sessions for affected users are invalidated immediately on disable.