Set Up Single Sign-On

Setting up has four parts: add a connection, test it, enable it, then allow people to use it. Passwords keep working throughout. Nothing here locks anyone out.

Before you begin

• You are an Admin of the organization. Only Admins see Single sign-on in Settings.
• The organization is on the Professional plan or above. Below it, the section shows "Single sign-on starts on the Professional plan."
• At your identity provider, you can register an application and read its issuer, client ID and client secret.
• Your provider answers at an https address that Tamaat can reach.
• You know your own Tamaat password. Tamaat asks for it again before it changes these settings, unless you entered it in the last five minutes.

Check Providers You Can Connect first. If your provider is Keycloak, Connect Keycloak gives the same steps with Keycloak's own names.

Add, test, enable

1. 1

   Open Settings and choose Organization → Single sign-on. Your organization's name is at the top. Under Connection, choose "Add connection".

2. 2

   Under "Identity provider", choose yours: Microsoft Entra ID, Okta, Keycloak, Red Hat build of Keycloak, or "Other (OpenID Connect)".

3. 3

   At your provider, register an application for Tamaat and note its issuer, client ID and client secret. Leave its redirect address for the moment; Tamaat gives you that next.

4. 4

   Back in Tamaat, fill in the fields under "From" your provider, then choose "Save":

   • "Connection name": a name your people will recognise. They see it when they sign in.
   • "Issuer": your provider's address for this application, exactly as the provider gives it.
   • "Client ID" and "Client secret": from the application you registered.
   • "Secret expiry date (optional)": the day the secret ends at your provider, so the connection shows it.
5. 5

   The form says "Saved." and shows a new step, "Copy into" your provider, with two values. Use "Copy" beside each one; do not retype them.

   • "Redirect URI": paste it into the application at your provider. This is where your provider sends people back.
   • "Sign-in address": the address that starts a sign-in through this connection. Keep it. You can give it to your people as a bookmark, or use it for a tile in your provider's portal.
6. 6

   Choose "Save and test". Tamaat sends you to your provider. Sign in there as you normally would. You come back to the result: "Passed" or "Failed". "The test did not sign anyone in."

7. 7

   On a passed test, choose "Enable connection". The connection now reads "Active".

8. 8

   Under Sign-in policy, choose "Optional": "Password or single sign-on".

People can now sign in through your organization. Try it yourself in a private browser window, then ask one invited member to try. Sign In With Your Organization shows what they will see.

Read the test result

A passed test lists what your provider sent. Each line matters for something later.

Line	What it tells you
"Permanent ID received"	Your provider sent an ID for the person that never changes. Tamaat recognises people by it, not by their email address.
"Email received"	Your provider sent the person's email address.
"Sign-in time received"	Your provider says when the person signed in. You need this before an invited person can accept their invitation with your sign-in, before you can require single sign-on, and before a published map or dashboard can open with your sign-in.
"Two-factor"	"Reported" or "Not reported": whether your provider said the person used a second step.
"Email: confirmed by your provider"	New people are let in without another check of their address.
"Email: people confirm with a code the first time"	A new person types a code that Tamaat emails them, once.
"Groups: received"	Shown when you asked for groups. The number is how many groups the test person is in.

A failed test shows one sentence that says what to fix. Choose "Edit connection", correct it, and choose "Test again". Troubleshoot Single Sign-On lists every sentence.

What each state means

State	Meaning
Draft	Saved, not tested yet.
Testing	A test is under way.
Tested	The saved settings passed their test. Ready to enable.
Active	People sign in through it.
Disabled	Kept, and nobody can sign in through it.

Testing, enabling and requiring are three separate things. A passed test changes nothing for your people. Enabling lets them use the connection once the policy is Optional. Only Required takes passwords away.

Groups

Fill these in only if you plan to open a published map or dashboard to chosen groups at your provider. Otherwise leave them empty.

• "Where your provider lists groups": the name under which your provider sends a person's groups.
• "Groups are sent as": "IDs" or "Names". With Microsoft Entra ID chosen, this is set to "IDs" and cannot be changed.

Groups never change a person's role in Tamaat. See Open a Map or Dashboard to Your Company.

Domains

A verified email domain lets your people start from the ordinary sign-in page: they type their work email and Tamaat takes them to your sign-in. Without one, they use the "Sign-in address" you copied earlier.

1. 1

   Under Domains, choose "Add domain" and enter the domain, such as example.com.

2. 2

   Choose "Show record". Tamaat shows a DNS record: its "Type", "Name" and "Value". Add that record where your domain's DNS is managed.

3. 3

   Choose "Check now". The domain changes from "Waiting for DNS record" to "Verified" once Tamaat finds the record. If it says "We could not find the DNS record yet. It can take a while to appear. Try again later.", wait and check again.

"A verified domain sends people to this sign-in. It does not add members." A domain leads to one organization at a time.

Change a connection later

Each connection shows its actions in view:

• "Edit" opens the form. Saved changes are a new version, and the version people sign in with stays in use until you test the new one and choose "Enable connection" again. The issuer of a saved connection cannot be changed; add a new connection for a different issuer.
• "Replace secret" stores a new client secret. Tamaat never shows a saved secret again.
• "Test connection" tests the saved settings without signing anyone in.
• "Disable" stops sign-in through an active connection: "People cannot sign in through this connection until it is enabled again. Anyone it signed in is signed out."
• "Remove" deletes a connection that is not active: "Its settings are deleted."

An organization can keep up to five connections, which is enough to set up a replacement beside the one in use.

People and activity

Two lists at the bottom of the section show what is happening:

• People lists everyone who has linked an account to your sign-in, with "Last sign-in". Remove Someone's Access covers "Remove link".
• Activity lists recent sign-ins, refused sign-ins and changes to these settings, each with a "Support code".

Next steps

1. Show members how to sign in
2. Require single sign-on
3. Troubleshoot a failed test