# Single Sign-On
URL: /docs/reference/single-sign-on
LLM index: /llms.txt
Description: Configure OIDC SSO for a Limrun organization.

# Single Sign-On

Configure Limrun as an OIDC service provider. Limrun uses the user's verified email domain to select the organization's OIDC connection.

For the Okta Integration Network setup, see [Okta SSO](/docs/reference/single-sign-on/okta).

## Prerequisites

Before you configure SSO, make sure you have:

- Admin access to the Limrun organization.
- Permission to create an OIDC web application in your identity provider.
- Access to the DNS provider for the email domain your users sign in with.
- An email domain that belongs to the Limrun organization.

## Supported features

Limrun supports:

- OIDC authorization code flow
- SP-initiated SSO
- IdP-initiated SSO through OIDC third-party initiated login
- Just-In-Time provisioning
- Single Logout
- Universal Logout through Global Token Revocation

## Configuration steps

### Verify your email domain

Each SSO domain must be verified before users with that domain can sign in through the OIDC connection.

It requires access to your DNS records. If this is not viable,
reach out to us for manual verification.

1. Open [console.limrun.com](https://console.limrun.com).
2. Go to **Settings**.
3. In **Domain Verification**, add the email domain that should use SSO.
4. Create the TXT record shown in the verification dialog:

   | DNS field | Value |
   |---|---|
   | Type | `TXT` |
   | Host / Name | Copy from Limrun. |
   | Value | Copy from Limrun. |

5. After the DNS record is published, click **Verify DNS** in Limrun.

### Create the OIDC application

1. In your identity provider, create a new OIDC application.
2. Choose **Web Application** as the application type.
3. Use the authorization code flow.
4. Make sure the ID token includes the user's `email` claim.
5. Name the app `Limrun`.
6. Add this sign-in redirect URI:

   ```text
   https://api.limrun.com/authn/oidc/callback
   ```

7. If your provider asks for an initiate login URI, add:

   ```text
   https://api.limrun.com/authn/oidc/login
   ```

8. Assign the users or groups that should have access to Limrun.
9. Save the app.

### Copy the OIDC values

Copy these values from your identity provider:

| Limrun field | Provider value |
|---|---|
| Issuer URL | The `issuer` from the provider's OpenID configuration. |
| Client ID | The app's client ID. |
| Client Secret | The app's client secret. |

The issuer URL is the `issuer` value from your provider's OpenID configuration document. For example, with Okta:

```text
https://your-org.okta.com/.well-known/openid-configuration
```

Use the `issuer` value from that JSON document:

```text
https://your-org.okta.com
```

### Save the connection in Limrun

1. Return to [console.limrun.com](https://console.limrun.com).
2. Go to **Settings > Single Sign-On**.
3. Confirm the redirect URI shown in Limrun matches the redirect URI in your identity provider.
4. Enter the **Issuer URL**, **Client ID**, and **Client Secret**.
5. Click **Save**.

Limrun discovers the provider from the issuer URL and requests the `openid`, `email`, and `profile` scopes.

### Optional: configure Single Logout

If your identity provider supports OIDC Single Logout, add the **Post Logout Redirect URI** shown in Limrun to your OIDC application's allowed logout redirect URIs.

For production, this value is:

```text
https://console.limrun.com/authn/login
```

When a user signs out of Limrun, Limrun revokes the user's Limrun token and redirects through the provider's `end_session_endpoint` when the provider publishes one.

### Optional: configure Universal Logout

If your identity provider supports Global Token Revocation, configure this endpoint:

```text
https://api.limrun.com/authn/oidc/global-token-revocation
```

Limrun accepts these subject identifier formats:

| Format | How Limrun resolves it |
|---|---|
| `iss_sub` | Matches the OIDC issuer and the user's OIDC `sub`. |
| `email` | Matches the user's email after confirming the domain belongs to the OIDC connection's organization. |

## SP-initiated SSO

The sign-in process starts from the Limrun Console.

1. Go to [console.limrun.com/authn/login](https://console.limrun.com/authn/login).
2. Click **Continue with SSO**.
3. Enter your work email address.
4. Complete authentication in your identity provider.

If the email domain is verified and the provider sign-in succeeds, Limrun signs the user in and redirects them to the console.

## Troubleshoot

**Users see "SSO not configured".** Confirm the user's email domain is added under **Settings > Domain Verification** and shows **Verified**. Limrun only starts OIDC SSO for verified domains.

**The provider rejects the redirect URI.** Confirm that the redirect URI is exactly `https://api.limrun.com/authn/oidc/callback`.

**The provider returns an ID token without an email.** Configure the OIDC app so the ID token includes the user's `email` claim. Limrun requires the `email` claim to match the user to a verified organization domain.

**A user authenticates with the provider but cannot enter Limrun.** Confirm the user's email domain is verified in Limrun and assigned to the same organization as the OIDC connection.

## Notes

- Limrun supports OIDC SSO. SAML and SCIM are not configured from this guide.
- A Limrun organization has one OIDC connection.
- If a user signs in through SSO and does not already have a Limrun account, Limrun creates the user and adds them to the organization for that OIDC connection.
- If a user already exists with the same verified email address, a successful OIDC sign-in links that account to the OIDC identity for the organization.