Single sign-on (SSO)
Employees sign in through the corporate provider (Keycloak, AD FS, Entra ID and others) over OIDC or SAML 2.0; accounts are created on first sign-in.
Single sign-on (SSO) lets the company’s employees sign in to Buff through the corporate identity provider — the same one that opens their email and internal systems — without a separate password or email code. There is no need to create each user by hand: the account is created on first sign-in and goes straight into the organisation with the assigned role. A departed employee who has been disabled in the provider can no longer sign in.
Two protocols are supported — OpenID Connect (OIDC) and SAML 2.0 — which means any common provider: Keycloak, Active Directory Federation Services (AD FS), Microsoft Entra ID, Avanpost FAM, Blitz Identity Provider, Okta and others. Everything is set up by the organisation owner themselves, in the app, in a few minutes — without contacting support.
How sign-in works
- The employee presses “Sign in with company SSO” and enters their work email or the organisation name. From the verified email domain the service works out the organisation itself — see Company domains.
- The browser goes to the company’s provider. There the employee signs in as usual — with a password, a second factor, a smart card: the rules are set by your provider, and Buff does not see them.
- The provider returns the browser to Buff with a signed identity assertion. Buff checks the signature, the validity period and the audience, finds or creates the account and opens a session.
What stays with us and what stays with you:
| Company provider | Buff | |
|---|---|---|
| The employee’s password | checks it | neither knows nor stores it |
| Second factor, password policy, blocking departed employees | sets them | does not duplicate them |
The employee identifier (sub in OIDC, NameID in SAML) | issues it | stores it as the key linking it to the account |
| Email and name | passes them in the assertion | uses them as a hint for linking and for display |
| Role and permissions in the organisation | — | assigned by the owner (see Members and permissions) |
What you need to start
- Be an organisation owner in Buff.
- Have the right to register applications (clients) in your provider — or a colleague who has it.
- For OIDC: the provider’s address (issuer), the
client_idandclient_secretof the registered client. - For SAML: the provider’s single sign-on address (SSO URL) and its signing certificate in PEM format.
Step by step — in Setup.
What next
- Setup — the section in the app, the OIDC and SAML fields, what to register with the provider, examples for Keycloak, AD FS and Entra ID.
- Company domains — sign-in by work email and automatic linking of existing accounts; a TXT record for verification.
- Members and “SSO only” mode — creating accounts on first sign-in, the default role, linking existing accounts, turning off password sign-in, the owner’s fallback sign-in.
- Troubleshooting — what the error messages mean and how to fix them.
Export and integrity
Exporting the log to CSV and JSON Lines by the current filter, the file format, and checking the hash chain with your own tools.
Setting up single sign-on
The “Single sign-on” section: OIDC or SAML 2.0, values for the provider, SP metadata, a test sign-in. Examples for Keycloak, AD FS and Entra ID.