Skip to main content
Single sign-on delegates Alforse authentication to a SAML 2.0 , such as Okta, Entra ID, or Google Workspace. After you verify an email domain through DNS, Alforse routes ERP and MES users on that domain to the identity provider automatically. and other sign-in methods remain available until you enable Require SAML SSO. The Single Sign-On section appears on Settings → Security only when SSO is enabled for your account.

​
Connect your identity provider

Everything lives on one screen: Settings → Security, under “Single Sign-On” (saving needs settings update).

​
Verifying a domain

Each added domain starts Pending with a unique TXT challenge shown on the card: Publish the record at your DNS host, click “Verify”, and on a match the domain flips to Verified. Verification is one-time; the TXT record can be deleted afterwards. A Pending domain has no effect anywhere, so adding one is always safe.

​
How sign-in works

On the email-first login page, selecting “Continue” either redirects the user to the domain’s active IdP or continues to the standard magic-link flow. Before creating a session, Alforse requires the asserted email domain to match a verified domain on the connection. SSO provisioning is invite-first; it does not support self-service signup. An existing member’s first SSO login links the SAML identity to their account. A pending invite is accepted during the first SSO login and applies its assigned role. Alforse rejects all other users without provisioning an account. Create their invite in the employees directory, then retry.

​
Requiring SSO

The “Require SAML SSO” switch makes the IdP the only permitted authentication method for verified domains. Alforse refuses magic links, Google, and passkeys for those users. The switch appears only for an active connection, allowing you to verify sign-in before enforcement. Turning it off restores other methods. “Deactivate” deletes the connection, releases its domain claims, and also restores other methods. SSO sessions bypass Alforse’s two-factor challenge, including in controlled deployments, because the IdP enforces its own MFA policy. Magic-link logins still use Alforse’s challenge.