Single sign-on (SSO)

On the Agency plan your organization can sign its people in through its own identity provider. Single sign-on uses OpenID Connect, which every major provider supports.

1. Register Zefily at your provider#

Create an application (a "web" or "confidential" OIDC client) at your provider and register the redirect URI shown under Settings → Single sign-on. Note its issuer URL, client ID and client secret.

2. Connect it#

Owners and admins enter the issuer, client ID and client secret and Save. Zefily reads the provider's /.well-known/openid-configuration to check it. The secret is stored encrypted.

Role for people who join through SSO sets the role of someone who signs in for the first time (Viewer, Developer or Admin); change it later under Team.

3. Prove your email domains#

A provider can only sign in people whose email is on a domain you own. Under Email domains, add the domain (e.g. example.com), add the TXT record shown at _zefily-sso.<domain> at your DNS provider, then Check DNS. Public mail domains such as gmail.com can never be used, and a domain belongs to one organization.

Signing in#

On the sign-in page, people choose Sign in with SSO and enter their work email. Zefily sends them to your provider (multi-factor authentication happens there) and back. The ID token's signature, issuer, audience, nonce and expiry are checked, and the email must be confirmed by the provider and be on one of your verified domains. A new person gets an account and joins your organization; an existing account is signed in.

Requiring SSO#

With Require SSO, people of your verified domains can no longer sign in with a password. Owners keep password sign-in so that you are never locked out if the provider is down. Removing someone at your provider stops their next sign-in; remove them under Team to end their access to the organization.