Declara
⌘K
compliance-ownerengineerP1Updated
Was this page helpful?

Declara supports single sign-on over OIDC, not SAML. Every identity provider a company this size runs — Okta, Entra ID, Google Workspace, and similar — speaks OIDC, and it's what Declara's underlying auth library implements natively. If your provider only supports SAML, it isn't supported today.

Before you start

You need permission to manage workspace settings. You'll need, from your identity provider: an issuer URL, a client id, and a client secret, from an OIDC application you've registered there. You'll also need to add a DNS TXT record to the email domain you're connecting, to prove you control it.

Steps

  1. Open Settings → SSO and start a new connection.
  2. Enter the email domain this connection applies to — only addresses on this domain will be able to sign in through it.
  3. Enter a name — what people see on the sign-in page.
  4. Enter the issuer URL: the URL your provider's OpenID configuration document sits under, with no trailing slash.
  5. Enter the client id and client secret from your provider's OIDC application.
  6. Choose the default role new people get the first time they sign in through this connection.
  7. Save. Declara shows you a redirect URI to paste into your identity provider's application settings, and a TXT record to add to your domain's DNS.
  8. Add the TXT record, then come back and check DNS. The connection can't be turned on until domain ownership is verified this way.
  9. Once verified, turn the connection on.

What you should see

The connection shows as Unverified until the DNS check passes, then Verified, off until you turn it on, then On. People signing in with an email on the connected domain are routed through your identity provider instead of the emailed sign-in link.

Removing an active connection cuts off that sign-in route right away for everyone using it — it has to be set up and re-verified from scratch to bring back.

Domains like gmail.com or outlook.com can't be connected. Claiming one would hand every account on that provider to whoever set it up — the check exists specifically to block that.

Related