> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outerlayer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on

> Let members sign in to OuterLayer with your identity provider over SAML, and require it for your email domains.

Single sign-on (SSO) lets members sign in to OuterLayer with your identity provider over SAML. After you set it up, people with an email address on your domain choose **Sign in with SSO** on the sign-in page. You can then require SSO for those domains.

Every plan includes SSO.

## Before you start

You need:

* **The Owner or Admin role.**
* **Your identity provider's SAML metadata URL.** It must start with `https://`.
* **The email domains your members use.** Only one organization can verify a domain.
* **Access to your domain's DNS records.** You add one TXT record for each domain to prove you own it.

A [custom role](https://docs.outerlayer.ai/roles-and-permissions.md#custom-roles) needs these permissions:

| Action | Permission |
| - | - |
| View the configuration and test the connection | **View SSO configuration** |
| Save the configuration, activate SSO and enforce SSO | **Configure SSO** |

Only an owner can delete the configuration.

## Set up SSO

1. Open the account menu at the bottom left, then choose **Organization settings → SSO**.
2. Enter your identity provider's metadata URL in **Identity provider metadata URL**.
3. In **Allowed email domains**, type a domain and press Enter. Do this for each domain.
4. Choose **Save**. The status changes to **Configured**, and each domain shows **Not verified**.
5. [Verify each domain](#verify-a-domain).
6. Choose **Test connection**. The result lists any errors and shows the **ACS URL**.
7. In your identity provider, enter the **ACS URL** as the assertion consumer service URL.
8. Turn on **Activate SSO**.

You can turn on **Activate SSO** only after you verify at least one domain.

## Verify a domain

OuterLayer uses a domain for SSO only after you prove you own it.

1. Find the domain under **Domain verification**. It shows a **Record name** and a **Record value**.
2. Add a TXT record with that name and value at your DNS provider.
3. Choose **Verify**. The domain shows **Verified**.

For `example.com`, the record name is `_outerlayer-sso.example.com`. The value is `outerlayer-sso=` and then a token.

If the page says it could not find the TXT record, wait and choose **Verify** again. A DNS change can take up to an hour.

A verified domain stays verified until you remove it from the list. OuterLayer does not check the record again.

### If a domain is already in use

Only one organization can verify a domain. If another organization verified the domain, **Save** fails and says the domain belongs to another organization. If the domain is yours, email [hello@outerlayer.ai](mailto:hello@outerlayer.ai).

## Activate and require SSO

**Activate SSO** lets members sign in with your identity provider. A member's email address must be on a domain you verified. Password, GitHub and Google sign-in still work.

**Enforce SSO** requires SSO for every email address on a verified domain. You can turn it on only while SSO is active.

> [!WARNING]
>
> Sign in with SSO yourself before you turn on **Enforce SSO**. When it is on, nobody on a verified domain can sign in with a password, GitHub or Google.

When **Enforce SSO** is on:

* OuterLayer refuses every sign-in for a verified domain that does not come through SSO. This includes a password, GitHub, Google and an email link.
* A person who signed in another way is signed out when their session next renews.
* The rule applies to the person's whole account, not only to your organization.

If you remove the last verified domain, both switches turn off. If you turn off **Activate SSO**, **Enforce SSO** turns off too.

## Sign in with SSO

1. On the sign-in page, enter your work email address.
2. Press Tab to leave the email field. The page checks your domain.
3. Choose **Sign in with SSO**. Your identity provider opens.

The button shows only when SSO is active and your domain is verified.

SSO does not add anyone to the organization. [Invite each person](https://docs.outerlayer.ai/invite-your-team.md) first. OuterLayer refuses an SSO sign-in from a person with no account.

## Names and email

OuterLayer reads each member's email address from the SAML response. It reads the name from these attributes:

| Name | SAML attributes |
| - | - |
| Full name | `http://schemas.microsoft.com/identity/claims/displayname`, `displayName`, `name`, `cn` |
| First name | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`, `FirstName`, `givenName`, `first_name` |
| Last name | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`, `LastName`, `sn`, `surname`, `last_name` |

A new member whose response has none of these gets their email address as their name.

## See who signed in

While SSO is active, **Members who signed in with SSO** lists each person and the date of their last sign-in.

## Change or delete the configuration

To change the metadata URL or the domains, edit the fields and choose **Save**.

To delete the configuration, choose **Delete SSO configuration** and type `delete` to confirm. Only an owner can delete it.

A delete removes the configuration, the connection to your identity provider and the list of members who signed in with SSO. It removes no member from the organization.

## Next steps

* [Invite your team](https://docs.outerlayer.ai/invite-your-team.md) to add the members who sign in with SSO.
* [Roles and permissions](https://docs.outerlayer.ai/roles-and-permissions.md) lists what each role can do.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.