Enterprise SSO

Employee Sign-In Through Your Own OpenID Connect Provider

Enterprise SSO in DockRay lets you connect your organization's account to your own identity provider that supports OpenID Connect (OIDC). This allows users to sign in to DockRay using their company accounts and existing authentication system.

Single Sign-On for Your Entire Team

Enterprise SSO lets you use your organization's centralized identity system to sign in to DockRay. Users authenticate with your company's identity provider and then gain access to their existing DockRay account.

OpenID Connect

The integration uses the OpenID Connect standard and the Authorization Code Flow with PKCE. This allows it to work with external identity providers that support this standard.

Secure Authentication

DockRay verifies the information provided by the identity provider, including the token signature, issuer and audience, expiration time, and the data required to securely link the user.

The email address must be verified by the identity provider before it can be used during sign-in.

Controlled Access to Your Organization

Enterprise SSO does not automatically create new DockRay accounts or users. Only an existing user belonging to the appropriate DockRay account can sign in through the identity provider.

This provides the convenience of centralized authentication without automatically granting access to new users.

Installation

You can configure the integration in the DockRay dashboard under Settings → Enterprise SSO.

Configure an OpenID Connect application with your identity provider.
In DockRay, enter the issuer URL, Client ID, Client Secret, and organization identifier.
In your identity provider, add the DockRay callback URL as the exact Redirect URI.
Enable the Authorization Code Flow and the openid, profile, and email scopes.
Save the configuration and test the sign-in process using your company account.

The Redirect URI has the following format:

https://dockray.io/sso/{identifier}/callback

Your identity provider must support OpenID Connect and return a verified email address for the user.