> ## Documentation Index
> Fetch the complete documentation index at: https://oximy.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO

> Connect Sidekick to your identity provider for single sign-on.

Open **Settings → Sidekick → Auth** to control how people sign in to Sidekick. You can run a single provider or several at once, and you can turn each one off later as your setup matures.

<Warning>
  At least one auth provider must stay enabled at all times. Sidekick won't let you turn off the last remaining provider, since that would lock everyone out.
</Warning>

## Password

Password sign-in is on by default. Turn it off once you've set up SSO and want to require people to sign in through your identity provider instead.

## Social and enterprise SSO

<Tabs>
  <Tab title="Google">
    Social sign-in through Google works in two modes:

    * **Oximy-managed**: uses a shared Google app Oximy already operates. Turn it on and there's nothing further to configure.
    * **Company-owned**: uses your own Google app instead of the shared one. Enter:
      * **Client ID**
      * **Client secret**
      * **Routed email domains**: the domains that should be sent through this app.

    Company-owned is the right choice when you want sign-in attributed to an app your own company controls.
  </Tab>

  <Tab title="OIDC">
    Enterprise SSO through an OIDC provider. Enter:

    * **Issuer**
    * **Client ID**
    * **Client secret**
    * **Scopes**
    * **Domains**: the email domains this provider handles.

    <Steps>
      <Step title="Open the OIDC drawer">
        In **Settings → Sidekick → Auth**, open the OIDC configuration drawer.
      </Step>

      <Step title="Copy the redirect URI">
        The drawer shows the redirect URI Sidekick expects back from your provider. Copy it into your identity provider's application configuration.
      </Step>

      <Step title="Enter your provider's details">
        Fill in the issuer, client ID, client secret, scopes, and domains from your identity provider.
      </Step>

      <Step title="Save and test">
        Save the configuration, then sign in from an account on one of the configured domains to confirm the flow works end to end.
      </Step>
    </Steps>
  </Tab>

  <Tab title="SAML 2.0">
    Enterprise SSO through a SAML 2.0 provider. Enter:

    * **Entry point**
    * **IdP entity ID**
    * **Certificate or metadata XML**: paste a certificate directly, or provide metadata XML and let Sidekick read the certificate from it.
    * **Domains**: the email domains this provider handles.
    * **Attribute mapping** (optional): map your IdP's attribute names to the fields Sidekick expects, if they don't match by default.

    <Steps>
      <Step title="Open the SAML drawer">
        In **Settings → Sidekick → Auth**, open the SAML configuration drawer.
      </Step>

      <Step title="Copy the callback URL">
        The drawer shows the callback URL Sidekick expects back from your provider. Paste it into your identity provider's SAML application.
      </Step>

      <Step title="Enter your provider's details">
        Fill in the entry point, IdP entity ID, certificate or metadata XML, and domains. Add attribute mapping if your IdP sends attributes under different names.
      </Step>

      <Step title="Save and test">
        Save the configuration, then sign in from an account on one of the configured domains to confirm the flow works end to end.
      </Step>
    </Steps>
  </Tab>
</Tabs>

<Note>
  Secrets, such as client secrets, are write-only. Once saved, Sidekick won't display the value again; to change it, enter a new one.
</Note>

## Where to go next

<Card title="Directory sync" icon="refresh-cw" href="/docs/sidekick/admin/directory-sync">
  Keep who has Sidekick login access in sync with your identity provider automatically.
</Card>