Skip to main content

Authentication

Organization settings is where you control how people sign in to your organization. It has one section, Authentication.

Allowed authentication methods​

Konekti supports two ways of signing in, and you choose which of them your organization allows:

  • Username + password, where people sign in with an account created within Konekti
  • SAML 2.0, where people sign in through your own identity provider.

You can allow one or both, and at least one has to stay selected.

What you allow here decides what you can pick as someone's Authentication method when you create their account. See Users and groups.

Allowing both​

With both methods allowed, every account is still set to one of them. Someone with a password account signs in with their password, and someone set to single sign-on goes through your identity provider. This is the comfortable way to move an organization across to SSO, because you can switch people over one at a time, at your own pace.

Single sign-on only​

Turning off Username + password means everyone has to go through your identity provider.

warning

Switching to single sign-on (SSO) only takes effect immediately, and it also affects people who are already signed in:

  • Password sign-in stops working.
  • Anyone on a password account loses access as soon as their session refreshes, and need to be converted first.
  • Password resets no longer work for them.

Set up and test single sign-on first, and make sure you can still get in yourself, before you turn passwords off.

Users need an account first​

Users need to be created within Konekti before they can sign in using their single sign-on account. To do this create them in User management with Single Sign-On (SSO) as the authentication method. If there is no account for the email address your identity provider sends, the sign-in is refused.

Saving your changes​

Anything you change here is a draft until you save it. Use Save to apply your changes, or Undo changes to put them back the way they were.

When the settings are read-only​

If your Konekti was configured through environment variables when it was deployed, this page shows a Readonly notice and nothing can be edited. The settings still apply, they are simply managed in your deployment configuration instead of here. Ask whoever runs your Konekti installation to change them.

Setting up single sign-on​

Once SAML 2.0 is allowed, the SAML settings appear so you can connect your identity provider. That is a job of its own: see Set up single sign-on.