Set up single sign-on (OIDC)
Glassbreak Team · Published 2026-07-19
Organizations on the Business plan and above can federate login to their own identity provider — Microsoft Entra, Okta, Google Workspace, or any OpenID Connect (OIDC) provider — so teammates sign in with their work identity. Provisioning via SCIM is additionally available on Enterprise. Glassbreak's SSO is OIDC; SAML is not currently supported.
Configure the connection
You'll need an org owner or admin role in Glassbreak and admin access to your IdP.
- In your IdP, create an OIDC application (authorization-code flow with PKCE). Set the redirect URI to
https://app.glassbreak.io/api/auth/sso/<your-org-slug>/callback, substituting your organization's slug. - Note the application's issuer URL, client ID, and client secret.
- In Glassbreak, open Organization → SSO and enter the issuer URL, client ID, and client secret, plus any claim mapping you need. The secret is stored encrypted and is never displayed again — the settings page only shows whether one is configured.
- Use Test to confirm Glassbreak can reach your IdP's discovery document.
- Register your email domain(s) with the organization. New users signing in via SSO are only auto-created when their email domain is registered to your org.
- Have a teammate sign in at your organization's SSO link to verify end to end.
Existing teammates whose SSO email matches an invited-but-unactivated seat are linked automatically; accounts that already have a password are deliberately not taken over by SSO — that's an account-security guard, not a bug.
Enforcement — with a break-glass path
You can prefer or require SSO for the organization. Deliberately, the strictest policy is required with break-glass: at least one designated crisis admin (who has completed a break-glass verification drill in the last 90 days) retains password login. A crisis-response platform must not be lockable by an IdP outage — if your identity provider is down mid-incident, the crisis admin can still get in.
SSO users and encryption — an honest note
SSO authenticates a session; it cannot unlock end-to-end encrypted data. Your encryption keys are wrapped under a credential your IdP never sees, and there is no server-held key Glassbreak could substitute — that's the point of the design. So an SSO user who wants to use encrypted features (contacts, secrets, encrypted messages) sets a Glassbreak credential once, alongside their SSO login. Until then they can sign in and use non-encrypted surfaces. See docs on account setup for how that credential and its recovery kit work.
Plan gating applies only to changing SSO configuration. If you downgrade, existing SSO users keep signing in and you can still view or remove your config — you just can't modify it.