Single sign-on

Applies to Workletto 1.x.

With single sign-on, people sign in with the account they already use at work, from Google Workspace, Microsoft Entra ID (Microsoft 365) or Okta. The sign-in page gets a Sign in with button, such as “Sign in with Google Workspace”. Only admins set it up, under Manage, Settings, Single sign-on.

It uses OpenID Connect, which all three providers support. You register Workletto with your provider once; the provider gives you three things to paste into Workletto: an issuer, a client ID and a client secret.

Who can sign in this way

• Only addresses at your email domain, such as yourstudio.com. Workletto says “That account isn’t one of this organization’s email addresses” to anyone else.
• Only email addresses your provider has verified.
• Only people already in your organization, or invited to it. Someone already here signs in to their own account, matched by email. Someone with an invitation joins with the role the invitation gives them, and the invitation is used up. Anyone else is told “You’re not in this organization yet. Ask an admin to invite you”.
• If you tick Let anyone with an @yourstudio.com address join as a member, anyone at your domain can join as a member without an invitation.
• People an admin has turned off can’t sign in, with single sign-on or without it.

Set it up

1. Open Manage, Settings, and find Single sign-on.
2. Copy the Redirect address for your provider with Copy address. It looks like https://time.yourstudio.com/api/auth/callback/sso.
3. Register Workletto with your provider (below) and paste that address where it asks for a redirect or callback address.
4. Back in Workletto, fill in:
   • Provider name, for the button, such as Google Workspace.
   • Issuer, Client ID and Client secret from your provider.
   • Email domain, such as yourstudio.com.
5. Click Turn on single sign-on.

Workletto checks the issuer with your provider before saving. If it can’t reach it, it says “Couldn’t read the provider’s settings at” and the address it tried; if the issuer isn’t exactly what the provider calls itself, it says so and shows the right one. The button appears on the sign-in page straight away, with no restart.

The client secret is stored encrypted and never shown again. To replace it, type a new one and save; leave it empty to keep the saved one.

When someone signs in, Workletto asks the provider only for their name and email. The provider’s sign-in tokens are thrown away, never stored. Once single sign-on is on, Manage → Security & data lists it among the ways people sign in and the outside services the app connects to.

If you move your app to a new address, such as your own domain, the redirect address changes too: add the new one at your provider.

Google Workspace

In the Google Cloud console, create an OAuth client ID of the type Web application, and add the redirect address as an authorized redirect URI. The Issuer is https://accounts.google.com.

Microsoft Entra ID

In the Microsoft Entra admin center, under App registrations, register a new application with a Web redirect URI: the redirect address. Create a client secret under Certificates & secrets. The Client ID is the application (client) ID, and the Issuer is https://login.microsoftonline.com/ followed by your directory (tenant) ID and /v2.0.

Okta

In the Okta admin console, create an app integration of the type OIDC, Web Application, with the redirect address as its sign-in redirect URI. The Issuer is your Okta address, such as https://your-org.okta.com.

Screens at these providers change from time to time; their own help explains each step. What Workletto needs is the same everywhere: the redirect address at the provider, and the issuer, client ID and secret here.

Require single sign-on

Tick Require it for everyone but admins to stop members and managers signing in with a password. They see “Your organization signs in with Google Workspace” if they try. Invited people then join with the Join with button instead of choosing a password.

Admins can always sign in with their password too, so if your provider is down or its settings are wrong, you can still get in and fix them.

Turn it off

Click Turn off and confirm. Everyone signs in with their password again. People who only ever signed in through the provider have no password yet: make them a reset link.

Changes to these settings appear in the history as “Single sign-on”. Single sign-on isn’t available in the vendor’s online demo.