Skip to main content
Single sign-on (SSO) lets members sign in to OuterLayer with your identity provider over SAML. After you set it up, people with an email address on your domain choose Sign in with SSO on the sign-in page. You can then require SSO for those domains. Every plan includes SSO.

Before you start

You need:
  • The Owner or Admin role.
  • Your identity provider’s SAML metadata URL. It must start with https://.
  • The email domains your members use. Only one organization can verify a domain.
  • Access to your domain’s DNS records. You add one TXT record for each domain to prove you own it.
A custom role needs these permissions: Only an owner can delete the configuration.

Set up SSO

  1. Open the account menu at the bottom left, then choose Organization settings → SSO.
  2. Enter your identity provider’s metadata URL in Identity provider metadata URL.
  3. In Allowed email domains, type a domain and press Enter. Do this for each domain.
  4. Choose Save. The status changes to Configured, and each domain shows Not verified.
  5. Verify each domain.
  6. Choose Test connection. The result lists any errors and shows the ACS URL.
  7. In your identity provider, enter the ACS URL as the assertion consumer service URL.
  8. Turn on Activate SSO.
You can turn on Activate SSO only after you verify at least one domain.

Verify a domain

OuterLayer uses a domain for SSO only after you prove you own it.
  1. Find the domain under Domain verification. It shows a Record name and a Record value.
  2. Add a TXT record with that name and value at your DNS provider.
  3. Choose Verify. The domain shows Verified.
For example.com, the record name is _outerlayer-sso.example.com. The value is outerlayer-sso= and then a token. If the page says it could not find the TXT record, wait and choose Verify again. A DNS change can take up to an hour. A verified domain stays verified until you remove it from the list. OuterLayer does not check the record again.

If a domain is already in use

Only one organization can verify a domain. If another organization verified the domain, Save fails and says the domain belongs to another organization. If the domain is yours, email hello@outerlayer.ai.

Activate and require SSO

Activate SSO lets members sign in with your identity provider. A member’s email address must be on a domain you verified. Password, GitHub and Google sign-in still work. Enforce SSO requires SSO for every email address on a verified domain. You can turn it on only while SSO is active.
Sign in with SSO yourself before you turn on Enforce SSO. When it is on, nobody on a verified domain can sign in with a password, GitHub or Google.
When Enforce SSO is on:
  • OuterLayer refuses every sign-in for a verified domain that does not come through SSO. This includes a password, GitHub, Google and an email link.
  • A person who signed in another way is signed out when their session next renews.
  • The rule applies to the person’s whole account, not only to your organization.
If you remove the last verified domain, both switches turn off. If you turn off Activate SSO, Enforce SSO turns off too.

Sign in with SSO

  1. On the sign-in page, enter your work email address.
  2. Press Tab to leave the email field. The page checks your domain.
  3. Choose Sign in with SSO. Your identity provider opens.
The button shows only when SSO is active and your domain is verified. SSO does not add anyone to the organization. Invite each person first. OuterLayer refuses an SSO sign-in from a person with no account.

Names and email

OuterLayer reads each member’s email address from the SAML response. It reads the name from these attributes: A new member whose response has none of these gets their email address as their name.

See who signed in

While SSO is active, Members who signed in with SSO lists each person and the date of their last sign-in.

Change or delete the configuration

To change the metadata URL or the domains, edit the fields and choose Save. To delete the configuration, choose Delete SSO configuration and type delete to confirm. Only an owner can delete it. A delete removes the configuration, the connection to your identity provider and the list of members who signed in with SSO. It removes no member from the organization.

Next steps