Company sign-in

With company sign-in your people sign in to Stabiso with the account your company already manages: Okta, Microsoft Entra ID (the former Azure AD) or any other OpenID Connect provider. The passkey still follows every sign-in, so a stolen company password opens nothing on its own.

When someone leaves, switching them off at your provider is enough: they can no longer sign in here (once company sign-in is the only way in for their domain, see below). Their rights and roles stay on Settings → Users and Roles.

Set it up

Open Settings → Company sign-in (an administrator; or type "sso" in Tell me). The page walks through three steps.

1. Register the app at your provider. The page shows the redirect address to register, with a copy button, and the steps for the provider you pick:
   • Okta: Admin Console → Applications → Create App Integration → OIDC, Web Application. Add the address as the sign-in redirect URI and assign the app to your people.
   • Microsoft Entra ID: Entra admin center → App registrations → New registration (accounts in this organizational directory only). Add the address as a Web redirect URI and create a client secret.
   • Other: register a web app that signs in with OpenID Connect (authorization code).
2. Connect it here. Give the Okta domain (acme.okta.com), the Entra tenant (its id or primary domain, acme.onmicrosoft.com) or the provider's https issuer; the app's client id; its client secret; and the e-mail domains whose people sign in there (left empty: the domain of your own address). Stabiso asks the provider when you save, so only a connection that answers is kept. The secret is kept sealed and is never shown again; leave the field empty on a change to keep it.
3. Try it, then decide who signs in only this way. Sign out, choose Sign in with your company account, give your work address and sign in at your company's page, then with your passkey. After the first sign-in through the connection the switch Only this way can be turned on: Google and passwords then no longer open the organization for people of those domains. It cannot be turned on before, so nobody is locked out by a setting that does not work.

Signing in

On the sign-in page a person chooses Use your company account and gives their work address. The browser goes to the company's sign-in page and comes back; the passkey step follows as always (the first passkey is created then). Only people the organization invited sign in this way, and only into that organization. If an address signs in to several organizations through a company account, the organization's own link (a test copy's link, for example) names the one.

Rules

• The provider's answer is checked: signed by the provider's published keys, for this app, of this sign-in (nonce and PKCE), not expired, and with a verified address of one of the connection's domains. A sign-in that took more than ten minutes starts again.
• One connection per organization. Changing the provider or the app makes it untried again.
• Removing the connection lets its people sign in with Google or a password again.
• Saving and removing the connection are in the audit trail; the secret never is.
• Test copies do not copy the connection.

Not offered

SAML is not offered: Okta and Microsoft Entra ID both sign in with OpenID Connect, which needs no certificate exchange. Provisioning people from the provider (SCIM) is not offered either: invite them on Settings → Users.

The API: Company sign-in.