StephanieJoly4
183d034716
Reorganizing by Feature sections Capabilities folders to give an overview of each feature How-Tos folders to give guidance for advanced customizations Reorganized the Developers section as well, moving the API sub section there added some new visuals and videos to illustrate the How-Tos articles checked the typos, the links and added a section at the end of the doc.json file to redirect existing links to the new ones (SEO purpose + continuity of the user experience) What I have not updated is the "l" folder that, per my understanding, contains the translation of the User Guide - that I only edited in English <!-- CURSOR_SUMMARY --> --- > [!NOTE] > <sup>[Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) is generating a summary for commit 5301502a32856e5b45d7ef30253fa7db6dc55233. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Co-authored-by: github-actions <github-actions@twenty.com> Co-authored-by: Abdul Rahman <ar5438376@gmail.com> Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
106 lines
3.2 KiB
Plaintext
106 lines
3.2 KiB
Plaintext
---
|
|
title: SSO Configuration
|
|
description: Configure Single Sign-On for secure enterprise authentication.
|
|
---
|
|
|
|
## About SSO
|
|
|
|
Single Sign-On (SSO) allows your team members to log into Twenty using your organization's identity provider. This provides:
|
|
- **Centralized access control**: Manage access from one place
|
|
- **Enhanced security**: Leverage your existing security policies
|
|
- **Better user experience**: One set of credentials for all tools
|
|
|
|
## Supported Providers
|
|
|
|
Twenty supports SSO with:
|
|
- **SAML 2.0**: Works with most enterprise identity providers
|
|
- **Google Workspace**: For organizations using Google
|
|
- **Microsoft Entra ID**: (formerly Azure AD) For Microsoft environments
|
|
|
|
## Setting Up SSO
|
|
|
|
### Prerequisites
|
|
- Organization plan (cloud and self-hosted workspaces)
|
|
- Admin access to your identity provider
|
|
- Admin access to Twenty workspace
|
|
|
|
<Note>
|
|
**For self-hosting users willing to set up SSO**, reach out to contact@twenty.com
|
|
</Note>
|
|
|
|
### Configuration Steps
|
|
|
|
#### 1. Access SSO Settings
|
|
1. Go to **Settings → Security**
|
|
2. Find the **SSO Configuration** section
|
|
3. Click **Configure SSO**
|
|
|
|
#### 2. Choose Your Provider
|
|
Select your identity provider from the list or choose "Custom SAML" for other providers.
|
|
|
|
#### 3. Configure Your Identity Provider
|
|
You'll need to configure your identity provider with:
|
|
- **Entity ID**: Provided by Twenty
|
|
- **ACS URL**: The callback URL for authentication
|
|
- **Certificate**: For secure communication
|
|
|
|
#### 4. Enter Provider Details in Twenty
|
|
- **SSO URL**: Login URL from your provider
|
|
- **Entity ID**: Your provider's identifier
|
|
- **Certificate**: X.509 certificate from your provider
|
|
|
|
#### 5. Test and Enable
|
|
1. Click **Test Configuration** to verify setup
|
|
2. Enable SSO when testing is successful
|
|
3. Configure user provisioning preferences
|
|
|
|
## User Provisioning
|
|
|
|
### Just-in-Time (JIT) Provisioning
|
|
- Users are created automatically on first login
|
|
- Assigned default role automatically
|
|
- No manual user creation needed
|
|
|
|
### Manual Provisioning
|
|
- Invite users before they can log in
|
|
- Pre-assign specific roles
|
|
- More control over who can access
|
|
|
|
## Managing SSO Users
|
|
|
|
### Role Assignment
|
|
SSO users can be assigned roles like regular users:
|
|
1. Go to **Settings → Members**
|
|
2. Find the user
|
|
3. Change their role as needed
|
|
|
|
### Access Revocation
|
|
To remove access for SSO users:
|
|
- Remove them from your identity provider, or
|
|
- Remove them from the Twenty workspace
|
|
|
|
## Best Practices
|
|
|
|
### Security
|
|
- **Require SSO**: Disable password login for SSO users
|
|
- **Regular audits**: Review access periodically
|
|
- **Strong IdP policies**: Enforce MFA at the identity provider
|
|
|
|
### User Management
|
|
- **Clear naming**: Use consistent naming from your directory
|
|
- **Group mapping**: Map IdP groups to Twenty roles (if available)
|
|
- **Offboarding process**: Include Twenty in your deprovisioning workflow
|
|
|
|
## Troubleshooting
|
|
|
|
### Common Issues
|
|
- **Certificate errors**: Ensure certificate hasn't expired
|
|
- **URL mismatches**: Verify ACS URL matches exactly
|
|
- **User not found**: Check JIT provisioning settings
|
|
|
|
### Getting Help
|
|
If you encounter issues, contact support with:
|
|
- Error messages received
|
|
- Identity provider being used
|
|
- Configuration details (without sensitive data)
|