Single Sign-On centralises authentication: your people sign in to Illizeo with your identity provider’s credentials, over OAuth 2.0 / OpenID Connect.
Supported standards #
| Method | What it does | Where to configure it |
|---|---|---|
| Generic OAuth 2.0 / OpenID Connect | Your employees sign in through your identity provider | Settings → Authentication → OAuth |
| Google sign-in | A “Sign in with Google” button | Settings → Authentication |
| LinkedIn sign-in | A “Sign in with LinkedIn” button | Settings → Authentication |
| Microsoft Entra ID | SSO and directory provisioning, through a multi-tenant app your IT consents to | Settings → Connectors |
Step-by-step #
-
Register Illizeo with your identity provider #
Create an OAuth 2.0 / OIDC application on the provider side and collect three URLs — authorization, token, user info — plus a client id and a client secret.
-
Enter those values in Illizeo #
Settings → Authentication → OAuth. The five fields map one-for-one to what the provider gave you.
-
Test with a pilot account #
Run an SSO sign-in with a test account before rolling out. Matching is done on the email address.
-
Enforce SSO, or run it alongside passwords #
SSO can be made mandatory for the whole workspace, or coexist with local passwords. Keep one administrator account with a local password before enforcing it — that is your way back in if the provider goes down.
-
For Microsoft Entra ID, use the connector #
Entra is not configured on this screen but under connectors: your IT consents once to the “Illizeo Connect” application, which authenticates by certificate, never by a shared secret.
FAQ #
Is SAML 2.0 supported?
No. Illizeo speaks OAuth 2.0 / OpenID Connect, not SAML. There is no Entity ID, no ACS URL and no signing certificate to exchange.
Are there pre-built Okta, OneLogin or JumpCloud connectors?
No. The OIDC configuration is generic: it works with any provider exposing standard OAuth 2.0 endpoints, but there is no per-provider wizard. Only Microsoft Entra ID has a connector of its own.
What about automatic account provisioning?
It exists, but in the opposite direction from what people usually expect: Illizeo provisions into Microsoft Entra ID, the directory does not create employees in Illizeo. A write-back pass then pulls the work email Entra assigned back into Illizeo. Nothing is provisioned until a scope has been explicitly defined.
What happens if the identity provider is down?
If SSO is not enforced, local passwords still work. If it is enforced, only an account kept outside SSO gets you back in — which is why you set one up before switching over.
Does each company have its own provider?
Yes, the OAuth configuration belongs to each customer workspace.
What does not exist #
No SAML 2.0. No inbound SCIM 2.0 — your directory does not create employees in Illizeo. No dedicated Okta, OneLogin or JumpCloud wizard. No federation of several customer workspaces under one provider.
