Single sign-on lets your staff sign in to DataMind OS with their company account. Use this page to connect your identity provider, decide which email domains may sign in, and, if you want, turn off password sign-in for everyone except the built-in Admin role.
You need the SSO Configuration Manager permission to connect or change SSO. The SSO Configuration Viewer permission lets you read the settings without changing them. You also need access to your provider's admin console, where you register the app. For the wider area, see Administration.
If SSO has not been set up yet and you cannot set it up, the panel shows Single sign-on is not configured and asks you to contact an administrator with SSO permissions.
The wizard has four steps: Identity provider, Configure your provider, Access control and Review and activate.
For Google Workspace, the guide's Use this value button fills in the Issuer URL for you.
Your provider must send the user's email address with each sign-in. The Microsoft Entra guide includes a step that adds the claims for it.
Continue checks the current step before it moves on. The fields show what is missing, for example "Issuer URL is required", "Must be an absolute https URL", "Client ID is required", "Add at least one allowed domain" or "Default role is required". On a new configuration the client secret is required too: "Client secret is required". If the save fails, the reason shows above the buttons, falling back to "Failed to create SSO configuration" or "Failed to update SSO configuration". After you open Review and activate, Save configuration stays off for a moment, so a stray double click cannot save twice.
Allowed domains lists the email domains that may sign in with SSO. Type a domain and press Enter; a comma also adds it. Backspace in the empty field removes the last domain, and entries are saved in lowercase with duplicates removed. Enter the domain only, such as the part after the @ in your staff email addresses. Do not enter a web address or the @ itself, and do not add a port. You need at least one domain. The field hint reads "Press Enter to add a domain. Bare FQDNs only - not a URL, not @domain." If the entry is not a bare domain, an error asks you to enter one.
Default role is given to each person whose account is created on their first SSO sign-in. Only active roles appear in the list, and the field notes "Assigned to users created on their first SSO login." If that role is deactivated or deleted later, saving the configuration is refused with "Default role does not exist or is not active"; pick an active role. To change what a role can do, see Roles and permissions.
Test sign-in works only when SSO is enabled. Until then, hovering over the button shows "Enable SSO first to test a sign-in". Turning on Enable SSO also shows Sign in with SSO on the login page straight away, for everyone.
If you complete the test sign-in as a different user, your current administrator session is replaced. Complete the test as yourself, or sign in again afterwards.
SSO-only login means that only users with the built-in Admin role can sign in with a password. Everyone else signs in with SSO.
Before you turn it on, check two things:
Turning it on revokes every session and returns you to the login page. A user who tries to sign in with a password sees "Password login is disabled on this instance, sign in with SSO".
Turning it off takes effect at once, with no confirmation, and password sign-in returns for everyone. The message "Password login enabled for users." confirms the change.
The SSO tab shows the saved connection: the heading names your provider, or reads OpenID Connect provider for any other OpenID Connect issuer. Below it, Service provider details and Identity provider configuration list the saved values. The Client secret row shows only Set or Not set, and the badge reads Active or Disabled. A switch here turns SSO on or off; the messages "SSO enabled." and "SSO disabled." confirm the change.
To change the client secret, paste the new value into Client secret. To keep the stored secret, leave the field blank; the field reads "Currently set - leave blank to keep it".
The Callback URL cannot be changed. Its note reads "Fixed for this server - can't be changed here. Your identity provider must list this as an allowed redirect URI." You can copy it from Service provider details in the SSO panel.
When SSO is enabled, the login page shows Sign in with SSO. When a user signs in with the provider:
Messages you may meet are collected in Administration troubleshooting.
| Setting | What it does | Default |
|---|---|---|
| Issuer URL | The address of your identity provider. A discovery document URL also works: the /.well-known suffix is removed when you leave the field. Must be an absolute https address. | Empty, required |
| Client ID | The application ID your provider issued. | Empty, required |
| Client secret | The secret your provider issued. Afterwards the panel shows only whether it is set. | Required on first setup |
| Callback URL | The address your provider sends users back to after sign-in. | Set by the server, cannot be changed |
| Allowed domains | The email domains that may sign in with SSO. | Empty, at least one required |
| Default role | The role given to accounts created on a first SSO sign-in. Only active roles are offered. | Empty, required |
| Enable SSO | Turns SSO on and shows Sign in with SSO on the login page. | Off |
| Enable SSO login only | Only users with the built-in Admin role can sign in with a password. Needs SSO to be on. | Off |
| Permission | What it lets you do |
|---|---|
| SSO Configuration Viewer | Open the SSO tab and read the connection details. |
| SSO Configuration Manager | Set up SSO, edit it, turn SSO on or off and turn on Enable SSO login only. |
Without the Viewer permission, the SSO tab does not appear. Without the Manager permission, you can read the settings but not change them. See also the Permission reference.
The domain of their email address is not in Allowed domains. Click Edit configuration, add the domain in Allowed domains, and save.
Only users with the built-in Admin role can. Everyone else must use SSO, and a password attempt shows "Password login is disabled on this instance, sign in with SSO".
Turning it on revokes every session, so that everyone signs in again under the new rule. Sign in with SSO, or with your password if you have the built-in Admin role.
It turns off too, so password sign-in returns for everyone. You can turn Enable SSO login only on again once SSO is back on.
No. It is fixed for this server. Copy it from Service provider details and register it as shown in your provider.
Continue checks the current step first. Fill the fields it points to, for example the Issuer URL, the Client ID or the Default role. On a new configuration, the Client secret is required too.
Yes. Paste it into Issuer URL; the /.well-known suffix is removed when you leave the field, so the stored value is the plain issuer address.
Only if you want to change it. Leave Client secret blank to keep the stored one; the field reads "Currently set - leave blank to keep it". When you set SSO up for the first time, the secret is required.
Your provider's administrator must grant admin consent for your organisation. In the Microsoft Entra guide, this is the Grant admin consent step: open Permissions on the enterprise application and approve it there.
The setup wizard guides only these two providers. A saved configuration that uses another OpenID Connect issuer appears as OpenID Connect provider in the SSO panel.
The test sign-in opens in the same browser, so finishing it as a different user replaces your administrator session in every tab. Sign in again as yourself.
Yes. Open the SSO Logs tab in Audit, sign-in and notification logs.