Single Sign-On (SSO) Getting Started
Single Sign-On is available for enterprise plans. Upgrade your plan to use this feature.
If you use the self-hosted version, you must set up the license and then follow the sso server setup guide to use this feature.
This guide will help you set up Single Sign-On (SSO) for your organization using OpenID Connect.
Getting Started
First, you need to enable the SSO feature in your organization settings. To do this, follow these steps:
- Log in to your Tolgee account.
- Click on your profile picture in the top right corner and select
Organization settings. - Click the 'Enable SSO' button in the
Single Sign-On (SSO)section.
Configure the OIDC application with your Identity Provider (IdP)
Now you must register the OIDC application with your Identity Provider (IdP) and provide Client ID, Client Secret and well-known configuration URLs to Tolgee. Configuration OIDC application is different for each IdP, but commonly you need to set the Sign-in redirect URI (if you use Tolgee cloud URL is https://app.tolgee.io/login/auth_callback/sso) and Grant type to Authorization Code and Refresh Token. You can find a guide for popular IdPs in the section below.
Configure Tolgee
After you have registered and configured the OIDC application, you need to provide the following information to Tolgee:
| Property | Description |
|---|---|
| Domain name | E-mail domain used to identify the organization on the login page. Only a server administrator can set or change it |
| Client ID | Unique identifier for an application |
| Client Secret | Key used to authenticate the application |
| Authorization URL | URL to redirect users for authentication |
| Token URL | URL for exchanging authorization code for tokens |
The Domain name field is read-only for organization owners, so you cannot fill it in or change it yourself. Ask a
server administrator to set it for your organization. On Tolgee Cloud, contact us via the chat on our website or our
community Slack channel. On a self-hosted instance, ask the user who administers your Tolgee
server.
The domain name is required for an enabled SSO configuration, so you cannot turn SSO on until an administrator has set it. Members are matched to your organization by their e-mail domain when they log in.
After you have provided this information, click the Save button. You can now log in to your Tolgee account using SSO. For this purpose, you can use the Login with SSO button on the login page and provide your organization's domain name.