Company Sign-In: SSO, OIDC and SAML
Company sign-in lets your staff sign in to iKanban with your company's own identity provider, such as Okta, Microsoft Entra, Google Workspace or OneLogin. It is on the Pro+ plan. A workspace admin sets it up in Admin → Company sign-in.
Company sign-in adds a way to sign in. It does not turn off the others: Google, GitHub and email sign-in keep working for everyone.
The words
| Term | What it means |
|---|---|
| SSO (single sign-on) | Staff sign in once at your identity provider, and each app trusts that sign-in. When IT removes a person there, the person loses access to every app that uses it. |
| Identity provider (IdP) | The service that holds your company's users, such as Okta or Microsoft Entra. |
| OIDC (OpenID Connect) | A modern SSO standard built on OAuth 2.0. iKanban gets a client ID and a client secret. Your provider sends a signed token with the user's email. |
| SAML 2.0 | An older SSO standard that uses XML. Your provider gives a metadata URL or file. It sends a signed assertion with the user's email. |
Company sign-in works with any SAML 2.0 or OIDC identity provider, such as Okta or Microsoft Entra ID. Tested with Okta and Microsoft Entra ID, by OIDC and by SAML.
Use OIDC when your provider offers it. Use SAML when your provider supports only SAML.
How a sign-in works
- A staff member chooses company sign-in on the iKanban sign-in page and enters their work email.
- iKanban finds the workspace that proved that email domain, and sends the person to your identity provider.
- The person signs in there, with your company's password and MFA rules.
- Your provider sends the signed result back to iKanban's identity service at
auth.i-kanban.com. - iKanban signs the person in.
Values to give your identity provider
| Setting | OIDC | SAML |
|---|---|---|
| Redirect URI (OIDC) or ACS URL (SAML) | https://auth.i-kanban.com/oauth2/idpresponse | https://auth.i-kanban.com/saml2/idpresponse |
| SP entity ID (audience) | — | urn:amazon:cognito:sp:ap-southeast-1_dklDxbwVG |
| Scopes | iKanban asks for openid email profile | — |
the email claim | the attribute http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress | |
| Email verified | the email_verified claim, true | an attribute named email_verified, with the value true |
iKanban refuses a user whose email is not marked as verified. Many SAML providers do not send email_verified by default, so add it as an attribute statement in your provider.
For Microsoft Entra ID by OIDC, add the optional claims email and xms_edov to the ID token. Entra does not send email_verified for work accounts, so iKanban reads xms_edov instead. An Entra OIDC connection saved before iKanban read xms_edov gets the new setting only when an admin saves the connection again. For Entra by SAML, add email_verified as a claim with the fixed value true.
Next steps
- Set up Okta (OIDC) or Set up Okta (SAML), Set up Microsoft Entra ID, or the same values in your own provider.
- Prove your domain and connect.