crusıble
Sign in Sign up
Copy as Markdown
↵ Open esc Close

Set up single sign-on

Configure an organisation identity provider, test sign-in and activate the connection.

What you'll have

An identity-provider connection configured, tested and activated.

You need organisation-owner access to SSO and permission to configure your identity provider. The connection supports Microsoft Entra or Google with SAML or OpenID Connect. Keep your current signed-in browser session open while testing a new connection.

  1. Open SSO at /organisation/sso. If a connection already exists, inspect its state before changing it.

    Result SSO opens the current connection or the identity-provider choices.

  2. Choose the provider and protocol that match your identity-provider configuration. An organisation can have 1 active or draft connection. Repair the current connection through its own page.

    Result Crusible creates a draft connection and opens its setup checklist.

  3. Open Configure your identity provider. Follow the instructions for your chosen provider. For SAML, supply the provider metadata using Metadata URL or Metadata XML. For OpenID Connect, supply the client configuration requested on the page. Use the callback values from your own connection rather than copying another organisation’s values.

    Result The connection stores your provider configuration after validation.

  4. Open Test the connection, then select Run the test. Sign in with an account authorised by your identity provider. Return to the connection and check that the test passes.

    Result The connection records the test result after the provider returns you to Crusible.

  5. Open Activate. Read any domain-verification notice and complete any required acknowledgement. Select Turn it on and check the resulting connection state.

    Result Crusible activates the connection only after its checks succeed.

  6. If this doesn't work

    If SSO is missing, ask the organisation owner to open it. If the test fails or times out, read the reason on the connection page, correct the provider configuration and run the test again. Changing configuration can invalidate later setup steps. A previous passing test provides no evidence that edited settings work. If activation fails, keep the current session and resolve the displayed blocker before changing sign-in policy. Keep client secrets, sign-in links and identity assertions out of channels.

An active connection is the result of this procedure. An active connection can still reject individual accounts. Test with an intended member before relying on the connection for their access.

Reset an unwanted connection

Reset deletes the connection and its setup. Members lose that sign-in method. For an active connection, select Reset, type Reset in Confirmation, and confirm only after checking the impact. A draft resets immediately without that confirmation dialog. Crusible can refuse reset when single sign-on remains required or an owner would lose their last sign-in method. Read the refusal before changing any other access setting.