Single sign-on (SAML)

Single sign-on lets your team sign in to Fronko with your identity provider (Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud or any SAML 2.0 provider) instead of a Fronko password. It’s on the Enterprise plan. Owners and admins set it up; there’s one per organisation.

Set it up

1. In Fronko, open Integrations and choose Okta, Microsoft Entra ID or Other SAML provider. Click Connect and save.
2. Fronko shows its service provider details: the ACS URL and Entity ID. Create a SAML app in your identity provider with them, sending the user’s email address as the NameID (or an email attribute).
3. Copy your identity provider’s metadata URL into Fronko and save.
4. Assign the app to your people in the identity provider, then try signing in with Sign in with SSO.

The connection page shows step-by-step instructions for Okta and Entra ID.

How people sign in

• On the sign-in page, Sign in with SSO asks for their work email or your organisation’s handle.
• Or share your organisation’s sign-in link, /login/sso/your-handle.
• People without an account get one as a member the first time they sign in, if Create accounts on first sign-in is on.

Verify your email domain

Add your domain under Email domains and create the DNS TXT record Fronko shows. Once verified, people can sign in by typing just their work email, and their addresses don’t need a confirmation code.

Require single sign-on

With Require single sign-on on, passwords stop working for everyone except the owner, who keeps theirs so they can always get in to fix things.