Setting Up Single Sign-On (SSO)

Single Sign-On (SSO) lets your team sign in with an existing account from an identity provider, without having to set a password in awork.

---

Key Benefits and Use Cases

SSO makes signing in simple and consistent:

• Let your team members use their existing identity provider accounts instead of creating a new awork password
• Use a modern OpenID Connect login based on OAuth 2.0
• Optionally disable other sign-in methods once SSO is set up

---

How to Set Up Single Sign-On (SSO)

Choose a Supported Identity Provider

Supported identity providers include:

• Okta (website)
• Auth0 (website)
• Microsoft Entra ID (formerly Azure AD) (website)
• OneLogin (website)
• GSuite (Google IAM: website)
• Keycloak (website)

If your identity provider isn't listed, contact us via Support and we'll check if we can set up a connection.

Set Up SSO in awork

1. Go to Settings (gear icon in the bottom left of the main menu) > Integrations
2. Open the Integration Library and select your desired provider
3. Fill in the displayed fields and complete the setup

Enable Required Redirect URLs

The following redirect URLs must be enabled:

https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/{Name of Login Provider} https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

Service-specific redirect URLs:

• Web Login: https://app.awork.com/enterprise-login
• Slack Authorization: https://app.awork.com/api/v1/accounts/authorize-slack
• Microsoft Teams Authorization: https://app.awork.com/api/v1/accounts/msteams/authorize
• Zapier: https://app.awork.com/api/v1/accounts/authorize

---

Configure SSO via Okta

1. Open the Okta configuration at YOUR-SUBDOMAIN.okta.com/admin
2. Go to the Applications section in the menu
3. Add a new application and name it, for example, awork
4. Copy the Client ID, Client Secret, and Subdomain into the awork configuration and save by clicking Save

Also set the following in Okta under the Login section:

1. Initiate login URI: AWORK_SUBDOMAIN.awork.com/login
2. Login redirect URIs: https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/okta https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

)

---

Configure SSO with Auth0

1. Open the Auth0 configuration
2. Go to the Applications section in the menu
3. Add a new application of type Regular Web Applications and name it, for example, awork
4. Copy the Client ID, Client Secret, and Subdomain into the awork configuration and save
5. Set the following URLs in the Application URLs section:
6. Application login URL: AWORK_SUBDOMAIN.awork.com/login
7. Allowed callback URLs: https://app.awork.com/enterprise-login, https://app.awork.com/api/v1/accounts/authorize-slack, https://app.awork.com/api/v1/accounts/external/auth0, https://app.awork.com/api/v1/accounts/msteams/authorize, https://app.awork.com/api/v1/accounts/authorize
8. Allowed web origins: AWORK_SUBDOMAIN.awork.com app.awork.com

)

)

---

Configure SSO with OneLogin

1. Open the OneLogin configuration at SUBDOMAIN.onelogin.com
2. Go to the Applications section in the menu
3. Add a new application by clicking Add App in the top right and name it, for example, awork
4. Select OpenID Connect (OIDC) as the type, set the name to, for example, awork, and save
5. In the SSO section, you'll find your Client ID and Client Secret. You can find the Subdomain in your OneLogin account URL ({Subdomain}.onelogin.com). Enter these values in awork and save
6. Set the following URLs in the Configuration section:
7. Login URL: AWORK_SUBDOMAIN.awork.com/login
8. Redirect URIs: https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/onelogin https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

---

Configure SSO with Microsoft Entra ID (formerly Azure AD)

1. Open the Entra ID configuration in the Azure Portal

2. Click on App registrations in the Manage section of the menu

3. Add a new registration and name it, for example, awork SSO

4. Set Supported account types to Accounts in this organizational directory only (your Domain only - Single tenant) and enter https://app.awork.com/enterprise-login as the Redirect URI for the Web platform. Then click Register

   )

5. In the Overview, you'll find the Application (client) ID (= Client ID in awork) and the Directory (tenant) ID (= Subdomain in awork)

   )

6. Under Certificates & secrets, you can create a new Client secret and enter the value in awork as Client Secret.

)

7. Under Authentication, enter the following Redirect URLs for a Web platform:

https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/azure https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

)

Under Implicit grant and hybrid flows, you must check the box for ID tokens. Under Supported account types, Accounts in this organizational directory only (your Domain only - Single tenant) must be selected

)

The login flow uses the preferred_username claim of the Entra user by default. If you want to use the UPN instead, you can configure the UPN as an optional claim in the Token configuration:

• Token type: ID
• Claim: upn

Then click Add.

)

---

Configure SSO with GSuite (Google IAM)

1. Go to https://console.cloud.google.com/apis/credentials and select your project
2. Click on Create credentials and select OAuth client ID
3. Select Web application as the type
4. Give it a name, for example, awork
5. Add the following redirect URLs under URIs: https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/gsuite https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize
6. Save by clicking Create
7. You'll find the Client ID and the Client secret on the right, which you need to enter in awork

)

)

You can find more information about SSO with GSuite here.

---

Configure SSO with Keycloak

To set up Keycloak SSO via OpenID Connect:

1. Log in to your Keycloak admin console

2. Navigate to Clients

3. Download the client configuration file: Keycloak awork Client Configuration

4. Drag the file into the resource field to import the required settings

5. Save the new client

   )

6. In the Client Details, go to the Credentials tab and copy the Client secret

   )

7. In the Realm Settings, you'll find the .well-known/openid-configuration link at the end of the General settings (OpenID Endpoint Configuration). The URL typically looks like: https://{your-keycloak-url}/realms/master/.well-known/openid-configuration

   )

8. Contact Support with the Client ID, Client Secret, and the .well-known/openid-configuration URL so we can set up the integration for you

---

Configure Custom SSO Providers (OpenID Connect)

awork also supports other SSO providers that support OpenID Connect.

You'll need the complete OpenID Configuration URL (for example, https://custom-domain.com/.well-known/openid-configuration), the Client ID, and the Client Secret.

---

Sign In via SSO on app.awork.com

1. Go to app.awork.com
2. Select Sign in with SSO
3. Enter your workspace subdomain

You'll be redirected to the SSO login screen or, if you're already logged in, directly to your awork dashboard.

---

Tips and Notes

After Setup

If the configuration was successful, SSO Sign-in will be available in the login area.

Disable Other Login Methods

Once SSO is configured, you can disable and hide other login methods (email & password as well as social login via Google & Apple).

1. Go to Settings > General.
2. Disable other login options

This is only advisable if no external users are working in the workspace who are not managed through identity management.

Global vs. Workspace Login

If you've disabled email/password and/or social login, these options will still be shown on the global page app.awork.com. They'll only be hidden on your workspace page YOUR-WORKSPACE-SUBDOMAIN.awork.com.

Once SSO is configured, Sign in with SSO will also appear on YOUR-WORKSPACE-SUBDOMAIN.awork.com. You'll be redirected to the SSO login screen or directly to your dashboard.

---

Frequently Asked Questions (FAQs)

Is SSO available in every plan?

No, SSO is only available in the awork Enterprise plan.

Does awork support SAML 2.0?

No. awork does not support SAML 2.0 and uses OpenID Connect based on OAuth 2.0 instead.

Can my identity provider manage permissions, users, or groups in awork?

No. Permissions, users, and groups are currently not managed through the identity provider. SSO only enables login for existing awork user accounts that are matched via email address.

What happens if I remove the SSO settings after disabling other login options?

Email and password login will be automatically enabled again so you can log in with your admin account at any time.

Can I set up SSO with Keycloak in the awork web interface?

Not yet. Please contact Support to set up Keycloak SSO, as this is currently not possible through the web interface (coming soon).