Set up single sign-on

Single sign-on lets your team reach the console through your identity provider instead of a Bidirection password. Owners and Admins only — the panel does not appear for anyone else.

Before you start#

You need two things:

1. A domain verified by DNS. SSO routing requires the DNS TXT method specifically. A domain verified by the widget heartbeat authorizes the widget but is not eligible for SSO. See Verify your domain.
2. Your secret already in AWS Secrets Manager. Bidirection stores a reference, never the credential itself.

Configure it#

1. Open Settings · Workspace and find the Single sign-on card.
2. Choose your protocol — SAML 2.0 for enterprise IdPs like Okta or Azure AD, or OIDC for OpenID Connect providers.

3. Fill in the fields for that protocol:

   For SAML 2.0:

   Field	Example
   IdP entity ID	https://idp.acme.com/metadata
   IdP SSO URL	https://idp.acme.com/sso
   Signing certificate reference	arn:aws:secretsmanager:…:saml-cert

   For OIDC:

   Field	Example
   Issuer	https://idp.acme.com
   Client ID	bench-console
   Client secret reference	arn:aws:secretsmanager:…:oidc-secret

4. Tick Enable SSO for this workspace.
5. Press Save SSO configuration.

When it is live, the card header shows Enabled.

After it is on#

Members still need a membership in the workspace — SSO controls how they authenticate, not whether they belong. Add them first on Settings · Team. See Invite your team.