Skip to content
Vectis
Book a demo

Single sign-on

Let your people sign in to Vectis with their work accounts through your identity provider.

These guides are for your IT administrator. They explain how to set up single sign-on (SSO) between your identity provider (IdP) and Vectis, and how to provision users automatically with SCIM.

Supported identity providers

ProviderGuideProtocol
Microsoft Entra IDMicrosoft Entra IDOIDC / OAuth 2.0
Google WorkspaceGoogle WorkspaceOIDC / OAuth 2.0
OktaOktaOIDC / OAuth 2.0
Auth0Auth0OIDC / OAuth 2.0
Other OIDC providersGeneric OIDCOIDC / OAuth 2.0
SCIM 2.0 provisioningSCIM provisioningSCIM 2.0 / REST

If something doesn't work, see Troubleshooting.

How SSO sign-in works

Vectis works with any identity provider that supports OpenID Connect (OIDC) and OAuth 2.0.

  1. The user enters their email on the Vectis login page.
  2. Vectis checks the email domain against your organisation's SSO domains.
  3. If it matches, the user is sent to your organisation's identity provider.
  4. The user signs in with their work credentials.
  5. The identity provider sends them back to Vectis with an authorisation code.
  6. Vectis exchanges the code for an ID token and validates it.
  7. Vectis signs the user in.

What an SSO configuration includes

Each organisation's SSO configuration includes:

  • Provider type: the identity provider you use, such as Entra ID, Google or Okta.
  • Client ID and secret: the OAuth application credentials from your identity provider.
  • Issuer URL: the OIDC issuer URL used to validate tokens.
  • Domains: one or more email domains that route to your identity provider. You prove you own each one with a DNS TXT record.
  • Enforcement mode: whether SSO is optional, preferred or required.
  • JIT provisioning: whether users are created automatically the first time they sign in with SSO.
  • Role mappings: map groups in your identity provider to Vectis roles.
  • SCIM: automatic user lifecycle management.

Your redirect URI

Every guide asks you to register a redirect (callback) URI in your identity provider. It is your Vectis web address followed by /sso/callback:

https://<your Vectis address>/sso/callback

Replace <your Vectis address> with the address you use to open Vectis in a browser. The URI must match exactly, including https and with no trailing slash.