Connect a private installation to your identity provider

Name one identity provider for everyone on a {{brand}} Private installation, in the server's configuration, and read it back in the admin console.

In short

A {{brand}} Private installation has one identity provider for everyone. Its operators name it in the server's configuration, under Identity:Sso, and the admin console shows it back. Nothing is set up per organization or from a screen.

Before you start

Who: the operators of the installation set it in the server's configuration; a site admin reads it back in the console.
Plan: a private installation has one provider for everyone; nothing is set per organization.
First: an application at your identity provider that uses the authorization code flow, with the redirect address the console shows.

Steps

In the server's configuration, set Identity:Sso: Enabled, Authority (the provider's https issuer address), ClientId and ClientSecret.
Set EmailDomains, the domains the provider speaks for, and optionally Required, BreakGlassEmail, OrganizationId and DisplayName.
Restart the server.
Open "Admin console" › "Single sign-on". Check the sentence that says whether people can sign in, and register the redirect address it gives at your provider.

Good to know

Keep the client secret in the environment or a secret store, never in a file. The console never shows it, only whether one is set.
The provider is believed only for addresses at EmailDomains.
Required makes those addresses sign in through the provider only. BreakGlassEmail names the one administrator who keeps a password for the day the provider is down.
OrganizationId, when set, is the organization people who sign in are made members of. DisplayName is the name on the sign-in button.

If something goes wrong

Admin › "Deployment" names any setting that is missing.
The issuer answers for every account of its service: use your own tenant's issuer - for Microsoft Entra ID, https://login.microsoftonline.com/<your tenant ID>/v2.0.
"The identity provider refused the request.": check the client ID and secret.