Skip to main content

Setting up Single Sign-On (SSO) in Connie

Connect Connie to your organization's identity provider (Okta, Microsoft Entra ID, Google Workspace, Auth0, JumpCloud, and others) so your team logs in with their company credentials instead of a separate Connie password.

Connect Connie to your organization's identity provider (Okta, Microsoft Entra ID, Google Workspace, Auth0, JumpCloud, and others) so your team logs in with their company credentials instead of a separate Connie login.

Availability: SSO is included in the Enterprise plan. On Studio and Professional, it's available as an individual add-on. Contact us at [email protected] to inquire.

How SSO works in Connie

  • When SSO is enabled, users enter their email on the Connie login page as usual and are then redirected to your company's login page instead of receiving a login code.

  • Domains decide who gets redirected. Connie looks at the domain part of the email address (everything after the @). Example: [email protected] is redirected to Acme's SSO login. The match is exact, so mail.acme.com counts as a separate domain.

  • Each domain must be verified by adding a DNS TXT record. Users are only redirected once the domain shows as Verified on the SSO page.

  • One account can have multiple domains (e.g. acme.com and acme.io), and each domain is mapped to a specific identity provider.

  • Auto-provisioning (optional): people who sign in through your identity provider but aren't in Connie yet can be added to your account as members automatically.

Before you start

You'll need:

  1. The Settings permission in Connie. SSO is configured under Settings → SSO. Any user with access to Settings can set it up.

  2. Admin access to your identity provider (or a colleague from IT who has it). You'll be creating an app/integration on their side too.

  3. Access to your domain's DNS settings (or someone who can add a TXT record for you). Connie verifies that you control the email domain before it redirects anyone.

  4. Your identity provider's metadata URL (SAML) or issuer URL, client ID, and client secret (OIDC). See Finding your identity provider's details below if you're not sure where to get these.

Setting up an integration

Setup is a short wizard. You'll switch between Connie and your identity provider's admin console once, and add one DNS record at the end.

1. Open the wizard

Go to Settings → SSO and click New Integration (top right).

2. Choose your protocol

  • SAML 2.0: the enterprise standard. Works with Okta, Microsoft Entra ID, OneLogin, JumpCloud, Auth0 and most corporate IdPs.

  • OpenID Connect (OIDC): modern OAuth 2.0-based protocol. Works with Google, Microsoft Entra ID, Okta, Auth0 and JumpCloud.

Not sure which to pick? Ask your IT team. If your organization already uses SSO with other tools, they'll know. When in doubt, SAML 2.0 is the safest choice for corporate IdPs. For Google Workspace, use OIDC (see below).

3. Enter provider details

  • Provider Name: a friendly label so you can recognize the integration later, e.g. "Acme Okta".

  • Email Domain: the domain whose users should be redirected to this provider, e.g. acme.com. You can add more domains later.

  • Auto-provision users: check this if people who authenticate through this provider should be added to your account automatically. Leave it off if you want to invite users manually.

Click Continue.

4. Configure Connie in your identity provider

Connie now shows you the details your identity provider needs. Create a new application in your IdP's admin console and paste in these values using the copy buttons.

For SAML 2.0:

  • Entity ID / Audience URI

  • ACS URL (Assertion Consumer Service)

  • Single Logout URL

For OpenID Connect:

  • Authorized JavaScript Origin

  • Redirect URI / Callback URL

The ACS URL and the Redirect URI are specific to the email domain you entered in step 3, so always copy them from the wizard rather than from documentation. Once the app is created on your IdP's side, return to Connie and click Continue.

5. Enter your identity provider's configuration

For SAML 2.0, paste your IdP's Metadata URL, the URL where it publishes its SAML metadata XML.

For OpenID Connect, enter the Issuer URL, Client ID, and Client Secret from the application you created in step 4.

Then click Create Integration.

6. Add the DNS verification record

The wizard now shows a DNS TXT record that proves you control the domain. Add it at your DNS provider:

  • Type: TXT

  • Host / Name: the domain itself, e.g. acme.com (some DNS providers write this as @)

  • Value: the connie-domain-verification=… string shown in the wizard

Connie checks for the record every 15 minutes and switches the domain from Pending to Verified automatically once it is found. DNS changes can take up to 48 hours to propagate, though it is usually much faster. Until the domain is Verified, users are not redirected to your identity provider.

You can see the record again at any time: on the SSO page, open the domain's menu and choose Verification details. If the record isn't found within 3 days, the domain shows as Expired. Choose Retry verification from the same menu to get a new token, and update your DNS record with the new value.

7. Test the login

Once the domain shows Verified, open a private/incognito browser window and log in with an email address on the SSO domain. You should be redirected to your company's login page and land back in Connie after authenticating.

Adding another domain

On the SSO page, open the identity provider's menu and choose Add domain. Each domain gets its own ACS URL or Redirect URI, which you also need to add to the application in your identity provider. Open the provider's menu and choose Provider details to see the values for every domain. The new domain also needs its own DNS TXT record and shows as Pending until it is verified.

Finding your identity provider's details

For OpenID Connect, Connie needs the issuer URL plus the client ID and client secret of the application you created. For SAML 2.0, Connie needs the URL where your identity provider publishes its metadata XML. Here's where to find them for the most common providers.

Okta

OIDC

  • Issuer URL: https://YOURDOMAIN.okta.com or https://YOURDOMAIN.okta.eu

  • Where to find it: Okta Admin → Applications → open your app → Sign On → under OpenID Connect Metadata, look for "Issuer". The client ID and secret are on the app's General tab.

SAML

  • Metadata URL: Okta Admin → Applications → your app → Sign On → under Metadata details, copy "Metadata URL"

Microsoft Entra ID (Azure AD)

OIDC

  • Issuer URL: https://login.microsoftonline.com/<TENANT_ID>/v2.0

  • Find your Tenant ID under Azure Portal → Microsoft Entra ID, then insert it into the URL above. The client ID and secret come from the app registration's Overview and Certificates & secrets pages.

SAML

  • Metadata URL: Azure Portal → Enterprise Applications → your app → Single sign-on → under SAML Certificates, copy "App Federation Metadata Url"

Google Workspace / Google Identity

OIDC (use this for Google)

  • Issuer URL: https://accounts.google.com (always the same)

  • Create the client in Google Cloud Console → APIs & Services → Credentials → Create credentials → OAuth client ID (type: Web application). Paste Connie's Authorized JavaScript Origin and Redirect URI there, then copy the client ID and secret.

SAML

  • Google Workspace only offers its SAML metadata as a file download, not as a URL, and Connie needs a URL. Use OIDC with Google instead.

Auth0

OIDC

  • Issuer URL: https://YOUR-TENANT.eu.auth0.com/ or https://YOUR-TENANT.us.auth0.com/

  • Auth0 Dashboard → Applications → your application → Settings → Domain, Client ID and Client Secret

SAML

  • Metadata URL: Auth0 Dashboard → Applications → your application → Addons → SAML2 Web App → Usage tab → "Identity Provider Metadata". The URL has the form https://YOUR-TENANT.eu.auth0.com/samlp/metadata/YOUR_CLIENT_ID.

JumpCloud

OIDC

  • Issuer URL: https://oauth.id.jumpcloud.com/

  • JumpCloud → SSO Applications → your OIDC app → SSO tab for the client ID and secret

SAML

  • Metadata URL: JumpCloud → SSO Applications → your app → SSO tab → under JumpCloud Metadata, click "Copy Metadata URL"

Troubleshooting

  • The SSO tab is greyed out. Either your user doesn't have the Settings permission, or SSO isn't included in your plan. Hover over the tab to see which. SSO is part of Enterprise, and available as an add-on on Studio and Professional (contact [email protected]).

  • The domain stays on Pending. Connie hasn't found the TXT record yet. Open Verification details on the domain and check that the record's host is the domain itself and the value matches exactly. Connie re-checks every 15 minutes, and DNS changes can take up to 48 hours to propagate.

  • The domain shows Expired. The 3-day verification window passed without the record being found. Choose Retry verification on the domain, then update your DNS record with the new value.

  • Users aren't redirected to SSO. Check that their email domain exactly matches a Verified domain on the SSO page. Subdomains count as separate domains.

  • "No account found for this email" after a successful IdP login. The user authenticated with your IdP but isn't a member of your Connie account. Either invite them first, or enable Auto-provision users on the integration. The same fix applies if someone who already uses Connie elsewhere sees "SSO login failed" instead.

  • "Your email domain is not configured for SSO with this provider." Your identity provider returned an email address on a domain that isn't mapped to this integration. Add that domain to the provider in Connie, or correct the user's email in your IdP.

  • You're locked out. Contact support via the Support chat. We can always be reached even if SSO is misconfigured.

Need help? Our support team is happy to walk through the setup with your IT team. Reach out via the in-app Support chat.

Did this answer your question?