Single Sign-On
Single Sign-On (SSO) lets users authenticate with Vince Platform using their existing corporate identity provider (IdP) rather than a separate password. Once configured, you can optionally enforce SSO so that all users in the tenant must sign in through the IdP.
Vince Platform uses OIDC (OpenID Connect) for SSO. Any OIDC-compatible identity provider is supported.
Enforce SSO
The Enforce SSO toggle controls whether users can still sign in with a username and password.
| State | Effect |
|---|---|
| Off | SSO is available as an option — users can still sign in with email and password |
| On | All users must authenticate via the configured identity provider — email/password login is disabled |
Do not enable Enforce SSO until you have tested the SSO configuration and confirmed at least one admin can successfully sign in via the IdP. Enforcing SSO before it is working correctly will lock all users out of the platform.
Adding an identity provider
- Go to Administration → Company Management → Single Sign-On.
- Click + Add Identity Provider.
- Fill in the required fields:
| Field | Description |
|---|---|
| Name | A display name for this IdP — shown to users on the sign-in page |
| Issuer URL | The OIDC discovery endpoint base URL from your identity provider |
| Client ID | The application (client) ID registered in your identity provider |
| Client Secret | The corresponding client secret |
- Click Save.
Where to find the OIDC values
| Provider | Where to find the values |
|---|---|
| Microsoft Entra ID | App Registration → Overview (Client ID); Certificates & Secrets (Client Secret); Endpoints → OpenID Connect metadata document (use the base URL without /.well-known/openid-configuration) |
| Okta | Applications → your app → Sign On tab; Issuer is the Authorization Server base URL |
| OneLogin | Applications → your app → SSO tab |
Testing SSO before enforcing
After saving the identity provider:
- Open a private/incognito browser window.
- Navigate to the Vince Platform sign-in page.
- Select the identity provider from the sign-in options.
- Authenticate with your IdP credentials.
- Confirm you land on the platform with the correct user account.
Only enable Enforce SSO once this test succeeds for at least one admin account.
Managing identity providers
Use the ⋮ menu next to an identity provider to Edit its settings or Delete it.
Deleting an identity provider immediately removes the SSO option. If SSO is enforced and you delete the only identity provider, users will be locked out — contact Vince support to recover access.