# Single sign-on and SCIM

> Connect your company's OIDC or SAML identity provider to Vigilbase One, verify your email domain and provision users with SCIM.

Source: https://docs.vigilbase.com/one/getting-started/single-sign-on

Owners and admins can let colleagues sign in to Vigilbase One with your company's identity provider, using OpenID Connect (OIDC) or SAML 2.0. You can also issue a SCIM credential so your directory adds and removes members automatically.

You configure this on the **Settings** tab of [one.vigilbase.com/organization](https://one.vigilbase.com/organization), in the **Enterprise identity** card. Members without owner or admin rights see **SSO and SCIM configuration is restricted to an organization owner or admin.**

> [!NOTE]
> Passkeys and two-factor authentication stay personal account settings. Each person manages them in Vigilbase Identity. See [Sign in](https://docs.vigilbase.com/one/getting-started/sign-in).

## Add an identity provider

:::steps
1. **Open Enterprise identity.** Go to [one.vigilbase.com/organization](https://one.vigilbase.com/organization), open the **Settings** tab and click **Add provider**.
2. **Choose a protocol.** In **Add an identity provider**, set **Protocol** to **OpenID Connect (OIDC)** or **SAML 2.0**.
3. **Enter your email domain and issuer.** Fill in **Email domain** (for example `example.com`) and **Issuer URL**.
4. **Enter the protocol details.**
   - For OIDC: **Client ID**, **Client secret** and, optionally, **Discovery URL (optional)**.
   - For SAML: **SSO service URL** and **IdP metadata XML**.
5. **Click Create provider.** One shows **Verify the SSO domain** with a **TXT name** and **TXT value**.
:::

Ask your Vigilbase team for the redirect and service provider details to register on your identity provider's side.

## Verify your domain

Single sign-on only starts working for a domain after you prove you own it.

:::steps
1. **Publish the TXT record.** In your DNS, create a TXT record with the **TXT name** and **TXT value** from the dialog.
2. **Click Verify domain** on the provider's card in **Enterprise identity**.
:::

The provider's badge changes from **Verification required** to **Domain verified**. If you closed the dialog before copying the record, click **Get DNS record** to see it again.

Once the domain is verified, anyone who enters an email address on that domain at the sign-in page is sent to your identity provider.

## Provision users with SCIM

Each identity provider has a **SCIM provisioning** section.

:::steps
1. **Click Issue token.** One shows **SCIM credential issued** with the **SCIM base URL** and a **Bearer token**.
2. **Copy both values now.** One keeps only a digest of the token and cannot show it again.
3. **Configure your directory** with the base URL and token.
:::

When SCIM is **Active**, directory users receive member access. Groups in your identity provider never grant admin roles; change roles in One as described in [Members and roles](https://docs.vigilbase.com/one/getting-started/members-and-roles).

- **Rotate token** issues a new token. Update your directory with it.
- **Decommission** stops provisioning and revokes directory access. If it shows **Resume decommission**, click it to finish the teardown.

## Remove a provider

Click the delete button on the provider's card in **Enterprise identity**.