Single sign-on
Business and Enterprise organisations sign their people in with their own identity provider, and can require it.
With single sign-on, your people sign in to Showreel Studio with your own identity provider over OpenID Connect: Google Workspace, Microsoft Entra ID, Okta, JumpCloud, or any other that speaks it. It comes with the Business plan and Enterprise, for an organisation that has verified its domain.
Set it up
You need to be an owner.
- In the web app, open Organisation, then find Single sign-on. It shows a redirect address.
- In your identity provider, make a web application that signs in with OpenID Connect. Give it that redirect address, and note its client ID and client secret.
- Google Workspace: in Google Cloud Console, APIs & Services → Credentials → Create credentials → OAuth client ID, as a web application. The issuer is
https://accounts.google.com. Only accounts in your Workspace can sign in. - Microsoft Entra ID: App registrations → New registration, as a web platform, with a client secret. The issuer is
https://login.microsoftonline.com/<your tenant ID>/v2.0. - Okta: Applications → Create App Integration → OIDC → Web Application. The issuer is your Okta address, such as
https://yourcompany.okta.com.
- Google Workspace: in Google Cloud Console, APIs & Services → Credentials → Create credentials → OAuth client ID, as a web application. The issuer is
- Back in the web app, enter the issuer, client ID and client secret, and choose Set it up. The secret is kept sealed, and never shown again.
Test it
Sign out, then choose Sign in with single sign-on on the sign-in page, and enter your work email. Once an owner has signed in this way, the page says it's tested.
Require it
Tick Require it. From then on, everyone at your domain signs in through your identity provider, and their other sign-ins end at once. The software (showreel login) signs in the same way.
People who sign in for the first time through single sign-on join your organisation as members, or with the role an invitation gave them. Each person is linked to their identity at your identity provider the first time: from then on, only that identity signs in as them, even if someone else is given the same email address. Your provider must confirm the email address is verified (Microsoft Entra ID, which doesn't say, is trusted for addresses at your domain). Remove someone in your identity provider, and they can't sign in again. Sign-ins they already have last until they expire (a week in a browser, 30 days in the software): to end those at once, also remove them in Showreel Studio.
If your identity provider is down
Write to hello@showreelstudio.app from your account's email: Showreel Studio's staff can stop requiring single sign-on for your organisation, and say so in its activity log.