Skip to content

Commit 7539406

Browse files
onderayonderay
authored
Merge pull request #542 from kinde-oss/Feat/SSO-via-portal
2 parents 176cd3e + 333ef84 commit 7539406

File tree

4 files changed

+223
-0
lines changed

4 files changed

+223
-0
lines changed

‎src/content/docs/authenticate/self-serve-sso/add-sso-self-serve.mdx‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
---
2+
page_id: ab20745f-0918-403a-8103-fc5749082dba
3+
title: Add SSO connection via self-serve portal
4+
description: Guide for enabling a business customer to set up their own SSO enterprise connection via the self-serve portal.
5+
sidebar:
6+
order: 1
7+
relatedArticles:
8+
- a2668524-5842-4c68-ab50-30b7e8c3e842
9+
- f36bce4a-52bb-4785-865b-6b33356f9838
10+
topics:
11+
- self-serve-portal
12+
- organizations
13+
- billing
14+
sdk:
15+
- react
16+
languages:
17+
- javascript
18+
- jsx
19+
audience: developers
20+
complexity: intermediate
21+
keywords:
22+
- organization portal
23+
- enterprise connection
24+
- SSO
25+
- self-serve portal
26+
updated: 2025-08-25
27+
featured: false
28+
deprecated: false
29+
ai_summary: Guide for enabling a business customer to set up their own SSO enterprise connection via the self-serve portal.
30+
---
31+
32+
<Aside type="upgrade">
33+
34+
This feature is only available on the [Kinde Scale plan](https://kinde.com/pricing/)
35+
36+
</Aside>
37+
38+
Your business customers who have their own organizations in Kinde can set up and manage their own SSO connections. This can save time going back and forth trying to get app credentials configured. Instead, your customer (who is the Identity Provider for their users) can set up an app and use the credentials to configure a connection. While you manage Kinde settings as the Service Provider.
39+
40+
## Before an organization can set up an SSO connection
41+
42+
- Ensure that you have switched on the option in the [self-serve portal settings](/build/self-service-portal/self-serve-portal-for-orgs/)
43+
- Check that the person setting up the connection has the [right role and permissions](/manage-users/roles-and-permissions/user-roles/). They need to be an Admin.
44+
- Add a domain to the verified domains list for the org (see below). Connections can only be set up for verified domains.
45+
46+
### Add a verified domain to the customer organization in Kinde
47+
48+
This is like pre-setting the home realm domain for a connection.
49+
50+
1. Open the organization record in Kinde.
51+
2. If prompted, in the **Activate advanced organization features** box, select **Activate**.
52+
3. Go to **Policies** in the menu.
53+
4. In the **Verified domains** text field, add the customer's domain or domains. Add each on a new line. Make sure you include only the domain, e.g. `mybusiness.com` and not the full domain URL such as `http://www.mybusiness.com`.
54+
5. Select **Save**.
55+
56+
## Add an SSO connection via the self-serve portal (Instructions for end-users)
57+
58+
Provide these instructions to the customer in case they need assistance.
59+
60+
1. Navigate to the self-serve portal and select **SSO**.
61+
2. Select **Add connection**.
62+
3. Select the connection type and then select **Next**. The configuration dialog opens.
63+
4. Add a name for the connection - this name will be shown to end users when they sign in.
64+
5. Complete the other fields with details from your IdP, e.g. **Entity ID**, provisioning options, mapping, certificates, etc.
65+
6. Copy the **ACS URL** - you will need to add this to your IdP application.
66+
7. Select **Save**.
67+
68+
## Finish setting up the connection for the organization (Instructions for Kinde admin)
69+
70+
There are some enterprise connection functions that are only configurable by you in Kinde. After the customer has entered their details, you can finish setting up the connection.
71+
72+
Open the connection in Kinde and adjust any of the following settings (if relevant):
73+
- **Create a user record in Kinde** - Add users if they do not exist when signing in. This is switched on by default.
74+
- **Always show sign-in button** - Show the SSO button on the app home screen. This is switched on by default.
75+
- **Auto-add users** - Allows users to join the organization if their credentials are accepted. Default is switched on.
76+
- **Upstream params** - these have the following default, but more can be added at the customer's request.
77+
```txt
78+
{
79+
"login_hint": {
80+
"alias": "login_hint"
81+
}
82+
}
83+
```
84+
85+
## Make the connection available to end-users
86+
87+
This is the process for end-users to make the connection live. It can also be enabled in the Kinde admin.
88+
89+
1. Open the connection configuration dialog via the self-service portal (end users).
90+
2. Select the **Enable for organization** option.
91+
3. Select **Save**.
92+
93+
## Enable or disable a connection
94+
95+
1. Navigate to the self-serve portal and select **SSO**.
96+
2. Select the three dots menu on the connection card, and choose **Enable** or **Disable**.
97+
98+
## Delete a connection
99+
100+
1. Navigate to the self-serve portal and select **SSO**.
101+
2. Select the three dots menu on the connection card, and choose **Delete**.
102+
3. Confirm that you want to delete the connection.

‎src/content/docs/authenticate/self-serve-sso/manage-self-serve-connections.mdx‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
page_id: 6bfab126-8887-4030-97aa-f44335fe489d
3+
title: Manage SSO connections added by customers
4+
description: This is a support topic for when a business customer sets up their own SSO enterprise connection via the self-serve portal.
5+
sidebar:
6+
order: 2
7+
relatedArticles:
8+
- ab20745f-0918-403a-8103-fc5749082dba
9+
- a2668524-5842-4c68-ab50-30b7e8c3e842
10+
- f36bce4a-52bb-4785-865b-6b33356f9838
11+
topics:
12+
- self-serve-portal
13+
- organizations
14+
- billing
15+
sdk:
16+
- react
17+
languages:
18+
- javascript
19+
- jsx
20+
audience: developers
21+
complexity: intermediate
22+
keywords:
23+
- organization portal
24+
- enterprise connection
25+
- SSO
26+
- self-serve portal
27+
updated: 2025-08-25
28+
featured: false
29+
deprecated: false
30+
ai_summary: This is a support topic for when a business customer sets up their own SSO enterprise connection via the self-serve portal.
31+
---
32+
33+
If you allow your business customers to set up and manage their own SSO enterprise connections in your app, this topic describes how to help manage and troubleshoot the connections.
34+
35+
Self-serve portal connections for accessing your site or app are fully under your control. Even though your customer can do the basic configuration, there are some things you'll probably want to manage on your side, such as provisioning behavior and other connection defaults.
36+
37+
## Troubleshoot self-serve SSO connections
38+
39+
If a customer can't sign in using the SSO connection they set up, check these things.
40+
41+
- They have added the ACS URL to the application on their identity provider side
42+
- They have a verified domain (home realm domain) selected in the configuration
43+
- The email they are trying to test belongs to the verified domain
44+
- The credentials and certificates are all valid
45+
- The connection is enabled and is being accessed in the relevant environment
46+
- The org code is being passed when a user goes to sign in
47+
- If there are any issues with upstream params being parsed
48+
- All required fields are included in the configuration, including key attributes (if relevant)
49+
50+
## How to access and manage enterprise connections created by your customers
51+
52+
1. Open the organization for the customer.
53+
2. In the left menu, select **Authentication**. The customer's connections are shown.
54+
3. Select the three dots on the connection, and select **Configure**.
55+
4. In the connection configuration window, make the changes you want, and select **Save**.
56+
57+
## Enable or disable a connection
58+
59+
You might need to disable a connection if you think it has been compromised or at the customer's request.
60+
61+
1. Open the organization for the customer.
62+
2. In the left menu, select **Authentication**. The customer's connections are shown.
63+
3. Select the three dots menu on the connection card, and choose **Enable** or **Disable**.
64+
65+
## Delete a connection
66+
67+
This completely disables and deletes the connection. This action can't be reversed.
68+
69+
1. Open the organization for the customer.
70+
2. In the left menu, select **Authentication**. The customer's connections are shown.
71+
3. Select the three dots menu on the connection card, and choose **Delete**.
72+
4. Confirm that you want to delete the connection.

‎src/content/docs/authenticate/self-serve-sso/self-manage-sso-per-org.mdx‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
page_id: 2a54764d-eb85-4905-8098-9c4e7a5073d7
3+
title: Switch on SSO self-management per organization
4+
description: Set up access to the self-serve portal SSO function at the org-level
5+
sidebar:
6+
order: 3
7+
relatedArticles:
8+
- a2668524-5842-4c68-ab50-30b7e8c3e842
9+
- f36bce4a-52bb-4785-865b-6b33356f9838
10+
topics:
11+
- self-serve-portal
12+
- organizations
13+
- enterprise SSO
14+
sdk:
15+
- react
16+
languages:
17+
- javascript
18+
- jsx
19+
audience: developers
20+
complexity: intermediate
21+
keywords:
22+
- organization portal
23+
- enterprise connection
24+
- SSO
25+
- self-serve portal
26+
updated: 2025-08-25
27+
featured: false
28+
deprecated: false
29+
ai_summary: Set up access to the self-serve portal SSO function at the org-level
30+
---
31+
32+
<Aside type="upgrade">
33+
34+
This feature is only available on the [Kinde Scale plan](https://kinde.com/pricing/)
35+
36+
</Aside>
37+
38+
You can give specific permission for an organization to set up and manage SSO connections, without giving it to all organizations in your business.
39+
40+
1. In Kinde, open the organization you want to give access.
41+
2. In the side menu, select **Self-serve portal**.
42+
3. Switch on the SSO function.
43+
4. Select **Save**.
44+

‎src/data/sidebarData.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,11 @@ const sidebarData = [
152152
autogenerate: {directory: "authenticate/enterprise-connections"},
153153
collapsed: false
154154
},
155+
{
156+
label: "Self-serve SSO",
157+
autogenerate: {directory: "authenticate/self-serve-sso/"},
158+
collapsed: false
159+
},
155160
{
156161
label: "Multi-factor auth",
157162
autogenerate: {directory: "authenticate/multi-factor-auth"},

0 commit comments

Comments
 (0)