Single sign-on
Let members sign in with your identity provider over OpenID Connect or SAML 2.0. Verify your domains, connect and test the provider, turn it on, and require it.
Single sign-on lets your members sign in to FurniOps with your organisation's identity provider
(Okta, Microsoft Entra ID, Google Workspace and others), over OpenID Connect or SAML 2.0.
It is a plan feature (sso). Everything here is under Settings › SSO, for owners and admins.
The steps, in order:
Verify your domains
Single sign-on applies to the people whose email address is on a domain your organisation has
proved it controls. Choose Add a domain and enter it (acme.com). You get a DNS TXT record to
publish:
_furniops-challenge.acme.com. TXT "furniops-domain-verification=<token>"FurniOps checks for it every few minutes for a week; Check now looks straight away. Once seen, the domain is verified.
- Free mail domains (gmail.com and the like) cannot be claimed.
- A domain belongs to one organisation: the first to verify it.
- Up to 20 domains per organisation.
- Verified domains are re-checked daily. Keep the record in place: a domain whose record has been missing for 7 days lapses back to pending. A DNS resolver that does not answer never starts that clock.
Connect your provider
Choose Connect a provider and pick the protocol. An organisation has one connection.
OpenID Connect: register FurniOps as an application at your provider with the redirect
URI the page shows, then enter the provider's issuer URL, the client ID and the client
secret. FurniOps reads the provider's discovery document and checks it straight away. The secret
is stored encrypted and never shown again. FurniOps asks for openid email profile.
SAML 2.0: give the provider's metadata URL, or paste its metadata XML. FurniOps reads the provider's entity ID, single sign-on URL and signing certificates from it (unexpired; RSA of 2048 bits or more, or ECDSA; two at most, for a rotation). The page then shows our entity ID and our ACS URL (assertion consumer service, HTTP-POST): register both with your provider.
Choose the role for people who join through it: Admin, Developer, Analyst or Viewer (never Owner). People on a verified domain who are not yet members join at their first sign-in with this role.
The connection starts off. Anything the provider gets wrong is reported on the field it concerns.
Test it
Test sign-in has you sign in at the provider yourself; FurniOps reports what the provider said about you (your subject, your email, whether it is verified, whether it is on a verified domain) and records the test. It signs nobody in.
The dashboard gives you a one-time test link, valid for five minutes, that runs the test in your browser and brings you back to the SSO page. A test is needed before the connection can be turned on, and again after changing the provider's issuer or client, which turns the connection off.
Turn it on
Turn on lets members on your verified domains sign in with the provider. On FurniOps' sign-in page they choose Single sign-on and enter their work email, or just type their address: the sign-in page offers the provider for a verified domain.
Require single sign-on
Require it makes members whose address is on a verified domain sign in through the
provider to act in the organisation. Within seconds, their sessions and tokens that did not come
through it are refused, and they sign in again with the provider. Elsewhere they see 403
sso_required.
- Owners are exempt: they keep their own sign-in methods, so the organisation can always be recovered if the provider breaks.
- Members on other domains are not affected.
- A person in two organisations can use single sign-on for one and a password or passkey for the other.
Turning the provider off stops required sign-on too. Stop requiring lets members sign in their own way again, as well as with the provider.
How accounts are linked
The first time someone signs in through the provider, FurniOps links the provider's identity (its subject) to their account. A new link needs an email address on one of your verified domains that the provider does not say is unverified. The account then joins through a pending invitation, or with the connection's role.
A sign-in through a provider that reports a phishing-resistant or multi-factor method (MFA, a hardware or software key, a smart card) counts as two-step for FurniOps.
Disconnect, or give a domain up
- Disconnect removes the provider with every account link through it. Members keep their accounts and memberships and sign in their own way.
- Remove domain: members on it are no longer held to single sign-on, and nobody new joins through it. You can claim it again later, with a new DNS record.
Connecting, turning on and off, requiring, disconnecting and removing a domain need a sign-in within the last 10 minutes. Each change is recorded in the audit log.
Members and roles
The five built-in roles and exactly what each may do, inviting people, changing roles, removing members, seats, and how a change reaches tokens already issued.
Account security
Passkeys, two-step verification with an authenticator app, recovery codes, passwords, sessions, connected apps, and when FurniOps asks you to confirm it is you.