Nomain Docs

Appearance

Single sign-on (SSO) ​

Admin only

Single sign-on lets your organization's people sign in to Nomain with the same corporate identity they already use: Okta, Microsoft Entra ID, Auth0, Keycloak, and others. Instead of managing separate Nomain passwords, your users authenticate through your existing identity provider.

A tenant administrator sets this up directly from the Account screen, in a guided flow, with no support ticket and no waiting on Nomain staff.

Setting up SSO ​

  1. Open the Account screen from the user menu. In the Organization section, administrators see a Single Sign-On (SSO) card ("Connect your identity provider (Okta, Entra ID, Auth0…)").
  2. Click Configure SSO.
  3. A Configure Single Sign-On confirmation dialog appears. It explains that this opens the WorkOS configuration portal and that changes affect all users in your organization. Proceed only if you administer your identity provider.
  4. Click Continue to WorkOS.
  5. You are redirected to a secure, hosted configuration portal, where you connect and validate your identity provider by following its guided steps.
  6. Return to the Account screen. The SSO card reflects the updated connection status.
The Account screen's Single Sign-On card, with the Configure SSO button.The Account screen's Single Sign-On card, with the Configure SSO button.

Connection status ​

The SSO card shows the current state of your connection:

StatusMeaning
Not configuredNo connection has been set up yet.
Active · via <provider>SSO is live; users sign in through your provider.
Pending: finish setupSetup was started but is not yet complete. A new connection may stay pending until the first successful sign-in through your provider.
DisabledA connection exists but is currently inactive.

Good to know ​

Reconfiguring can interrupt sign-in

Editing an existing connection can interrupt sign-in for everyone in your organization, and the connection may stay Pending until the next successful sign-in. Change it during a maintenance window if you can, and make sure you have your identity provider's details ready.

  • Self-serve. No support ticket is required. You launch the guided portal yourself.
  • Organization-wide. SSO settings apply to every user in your organization, not just to the admin making the change.
  • Named providers. The interface names Okta, Entra ID, Auth0 and Keycloak. The underlying identity platform (WorkOS AuthKit) supports additional SAML and OIDC providers beyond these examples.
  • Admin only. The SSO card is visible only to administrators, and the setup endpoints are enforced server-side.