# Single sign-on (SSO)

> Employees sign in through the corporate provider (Keycloak, AD FS, Entra ID and others) over OIDC or SAML 2.0; accounts are created on first sign-in.

Single sign-on (SSO) lets the company’s employees sign in to Buff through the **corporate identity provider** — the same one that opens their email and internal systems — without a separate password or email code. There is no need to create each user by hand: the account is created on first sign-in and goes straight into the organisation with the assigned role. A departed employee who has been disabled in the provider can no longer sign in.

Two protocols are supported — **OpenID Connect** (OIDC) and **SAML 2.0** — which means any common provider: Keycloak, Active Directory Federation Services (AD FS), Microsoft Entra ID, Avanpost FAM, Blitz Identity Provider, Okta and others. Everything is set up by the **organisation owner** themselves, in the app, in a few minutes — without contacting support.

_Illustration: The sign-in screen: next to the password — “Sign in with company SSO”._

## How sign-in works

1. The employee presses **“Sign in with company SSO”** and enters their **work email** or the **organisation name**. From the verified email domain the service works out the organisation itself — see [Company domains](/en/docs/sso/domains).
2. The browser goes to the company’s provider. There the employee signs in as usual — with a password, a second factor, a smart card: the rules are set by your provider, and Buff does not see them.
3. The provider returns the browser to Buff with a signed identity assertion. Buff checks the signature, the validity period and the audience, finds or creates the account and opens a session.

_Illustration: Step 1: a work email or the organisation name._

_Illustration: Step 2: signing in on the company provider’s side — Keycloak here._

_Illustration: Step 3: the employee is in the app. The account was created automatically; they are a member of the organisation with the default role._

What stays with us and what stays with you:

| | Company provider | Buff |
| --- | --- | --- |
| The employee’s password | checks it | neither knows nor stores it |
| Second factor, password policy, blocking departed employees | sets them | does not duplicate them |
| The employee identifier (`sub` in OIDC, `NameID` in SAML) | issues it | stores it as the key linking it to the account |
| Email and name | passes them in the assertion | uses them as a hint for linking and for display |
| Role and permissions in the organisation | — | assigned by the owner (see [Members and permissions](/en/docs/teams)) |

## What you need to start

- Be an **organisation owner** in Buff.
- Have the right to register applications (clients) in your provider — or a colleague who has it.
- For OIDC: the provider’s address (issuer), the `client_id` and `client_secret` of the registered client.
- For SAML: the provider’s single sign-on address (SSO URL) and its signing certificate in PEM format.

Step by step — in [Setup](/en/docs/sso/setup).

## What next

- [Setup](/en/docs/sso/setup) — the section in the app, the OIDC and SAML fields, what to register with the provider, examples for Keycloak, AD FS and Entra ID.
- [Company domains](/en/docs/sso/domains) — sign-in by work email and automatic linking of existing accounts; a TXT record for verification.
- [Members and “SSO only” mode](/en/docs/sso/policy) — creating accounts on first sign-in, the default role, linking existing accounts, turning off password sign-in, the owner’s fallback sign-in.
- [Troubleshooting](/en/docs/sso/troubleshooting) — what the error messages mean and how to fix them.