Setting Up Single Sign-On (SSO)

Single Sign-On (SSO) lets your team sign in with an existing account from an identity provider - without having to set a password in awork.

---

Key benefits and use cases

SSO makes logins simple and consistent:

• Let your team members use their existing identity provider accounts instead of creating a new awork password
• Use a modern OpenID Connect login based on OAuth 2.0
• Optionally disable other login methods once you've set up SSO

---

How to set up Single Sign-On (SSO)

Choose a supported identity provider

Supported identity providers are:

• Okta (website)
• Auth0 (website)
• Microsoft Entra ID (formerly Azure AD) (website)
• OneLogin (website)
• GSuite (Google IAM: website)
• Keycloak (website)

If your identity provider isn't listed, contact us through Support and we'll check if we can add it.

Set up SSO in awork

1. Navigate to Settings (gear icon in the bottom left of the main menu) > Integrations
2. Open the Integration Library and select your desired provider
3. Fill in the displayed fields and complete the setup

Enable required redirect URLs

The following redirect URLs must be enabled:

https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/{Login Provider Name}
https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

Service-specific redirect URLs:

• Web Login: https://app.awork.com/enterprise-login
• Slack Authorization: https://app.awork.com/api/v1/accounts/authorize-slack
• Microsoft Teams Authorization: https://app.awork.com/api/v1/accounts/msteams/authorize
• Zapier: https://app.awork.com/api/v1/accounts/authorize

---

Configure SSO via Okta

1. Open the Okta configuration at YOUR-SUBDOMAIN.okta.com/admin
2. Go to Applications in the menu
3. Add a new application and name it, for example, awork
4. Copy the Client ID, Client Secret, and Subdomain to the awork configuration and save by clicking Save

In Okta, also set the following in the Login section:

1. Initiate login URI: AWORK_SUBDOMAIN.awork.com/login
2. Login redirect URIs: https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/okta https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

)

---

Configure SSO with Auth0

1. Open the Auth0 configuration
2. Go to Applications in the menu
3. Add a new application of type Regular Web Applications and name it, for example, awork
4. Copy the Client ID, Client Secret, and Subdomain to the awork configuration and save
5. Set the following URLs in the Application URLs section:
6. Application login URL: AWORK_SUBDOMAIN.awork.com/login
7. Allowed callback URLs: https://app.awork.com/enterprise-login, https://app.awork.com/api/v1/accounts/authorize-slack, https://app.awork.com/api/v1/accounts/external/auth0, https://app.awork.com/api/v1/accounts/msteams/authorize, https://app.awork.com/api/v1/accounts/authorize
8. Allowed web origins: AWORK_SUBDOMAIN.awork.com app.awork.com

)

)

---

Configure SSO with OneLogin

1. Open the OneLogin configuration at SUBDOMAIN.onelogin.com
2. Go to Applications in the menu
3. Add a new application by clicking Add App in the top right, and name it, for example, awork
4. Select OpenID Connect (OIDC) as the type, set the name to, for example, awork, and save
5. In the SSO section, you'll find your Client ID and Client Secret. You can find your Subdomain in your OneLogin account URL ({Subdomain}.onelogin.com). Enter these values in awork and save
6. Set these URLs in the Configuration section:
7. Login url: AWORK_SUBDOMAIN.awork.com/login
8. Redirect URIs: https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/onelogin https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

---

Configure SSO with Microsoft Entra ID (formerly Azure AD)

1. Open the Entra ID configuration in the Azure Portal

2. Click App registrations in the Manage section of the menu

3. Add a new registration and name it, for example, awork SSO

4. Set Supported account types to Accounts in this organizational directory only (your domain - single tenant) and enter https://app.awork.com/enterprise-login for the redirect URI on the Web platform. Then click Register

   )

5. In the Overview section, you'll find the Application (Client) ID (= Client Id in awork) and the Directory (Tenant) ID (= Subdomain in awork)

   )

6. Under Certificates & secrets, you can create a new Client secret and enter the value in awork as Client Secret.

)

7. Under Authentication, enter the following redirect URLs for a Web platform:

https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/azure https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

)

Under Implicit grant and hybrid flows, you must check the box for ID tokens. For Supported account types, select Accounts in this organizational directory only (your domain - single tenant)

)

The login flow uses the preferred_username claim of the Entra user by default. If you'd rather use the UPN, you can configure the UPN as an optional claim in Token configuration:

• Token type: ID
• Claim: upn

Then click Add.

)

---

Configure SSO with GSuite (Google IAM)

1. Go to https://console.cloud.google.com/apis/credentials and select your project
2. Click Create credentials and select OAuth Client ID
3. Select Web application as the type
4. Give it a name, for example, awork
5. Add the following redirect URLs to the URIs: https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/gsuite https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize
6. Save by clicking Create
7. On the right, you'll find the Client ID and the Client Secret, which you need to enter in awork

)

)

You can find more information about SSO with GSuite here.

---

Configure SSO with Keycloak

To set up Keycloak SSO via OpenID Connect:

1. Log in to your Keycloak Admin Console

2. Navigate to Clients

3. Download the client configuration file: Keycloak awork Client Configuration

4. Drag the file into the resource field to import the required settings

5. Save the new client

   )

6. In the Client Details, go to the Credentials tab and copy the Client secret

   )

7. In the Realm settings, you'll find the .well-known/openid-configuration link at the end of the General settings (OpenID Endpoint Configuration). The URL typically looks like this: https://{your-keycloak-url}/realms/master/.well-known/openid-configuration

   )

8. Contact Support with your Client ID, Client Secret, and .well-known/openid-configuration URL so we can set up the integration for you

---

Configure your own SSO provider (OpenID Connect)

awork also supports any other SSO provider that supports OpenID Connect.

You'll need the full OpenID Configuration URL (for example, https://custom-domain.com/.well-known/openid-configuration), Client ID, and Client Secret.

---

Sign in via SSO through app.awork.com

1. Go to app.awork.com
2. Select Sign in with SSO
3. Enter your workspace subdomain

You'll be redirected to the SSO login screen or, if you're already logged in, directly to your awork dashboard.

---

Tips and hints

After setup

If the configuration was successful, SSO Sign-in will be available in the login area.

Disable other login options

Once SSO is configured, you can disable and hide other login methods (email & password, as well as social login via Google & Apple).

1. Navigate to Settings > General.
2. Disable other login options

This is only recommended if no external users work in your workspace who aren't managed through your identity management system.

Global vs. workspace login

If you've disabled email/password and/or social login, these options will still appear on the global page app.awork.com. They'll only be hidden on your workspace page YOUR-WORKSPACE-SUBDOMAIN.awork.com.

If SSO is configured, Sign in with SSO will also appear on YOUR-WORKSPACE-SUBDOMAIN.awork.com. You'll be redirected to the SSO login screen or directly to your dashboard.

---

Frequently Asked Questions (FAQs)

Is SSO available in every plan?

No, SSO is only available in the awork Enterprise plan.

Does awork support SAML 2.0?

No. awork doesn't support SAML 2.0 and uses OpenID Connect based on OAuth 2.0 instead.

Can my identity provider manage permissions, users, or groups in awork?

No. Permissions, users, and groups are currently not managed through the identity provider. SSO only enables login for existing awork user accounts, which are matched via email address.

What happens if I remove the SSO settings after disabling other login options?

Email and password login will automatically be re-enabled so you can always log in with your admin account.

Can I set up SSO with Keycloak in the awork web interface?

Not yet. Please contact Support to set up Keycloak SSO, as this isn't yet available through the web interface (coming soon).