Connected Apps let your people sign in to other websites and apps, such as WordPress, Grafana, Moodle, Nextcloud or your own website, with the Kamo account they already have. It works like Sign in with Google, except the accounts are your organization's. One account and one password for everything, and when someone leaves your organization they can no longer sign in to any of the apps either.
Connected Apps
Open Settings, then Security, choose Identity & Sign-In, then Connected Apps. You need the Manage Connected Apps permission. Administrators have it already.
Nothing about how anyone signs in to Kamo changes. Apps appear here only when you connect them, and nobody is affected until they sign in to one of them.
Let Websites And Apps Sign In With Your Organization
The switch at the top makes your organization a sign-in provider. While it is On, the apps you connect can send people to your organization's sign-in page and get back who they are. While it is Off, every connected app stops signing people in; nothing is deleted, and turning it back on brings them all back.
You don't have to turn it on yourself: it turns on by itself when you connect your first app.
Your Sign-In Address
The address apps use to find your sign-in page, for example https://login.yourcompany.com. Apps also call it the issuer. It is pinned the first time the switch turns on and never changes on its own, so an app you set up today keeps working.
If your organization has its own verified web address, the sign-in address is on it. Otherwise it is on Kamo's address with your organization's number at the end.
The Discovery Address
One address that tells an app everything else it needs: where your sign-in page is, where to swap a sign-in code for tokens, and how to check signatures. Most apps ask only for this address (sometimes called the well-known or OpenID configuration address) and fill in the rest themselves. Press Open to see what apps read.
Moving To A New Address
If your organization gets its own web address after you connected apps, the card offers Move To The New Address. Your sign-in address moves to your own domain. The old address keeps working, so nothing breaks; update each app to the new address when it suits you.
Signing Keys
Kamo signs every sign-in it hands to an app, and the app checks the signature. The keys are replaced every 90 days on their own, with the next key published a week ahead so apps never notice. Use Rotate Keys Now only if you think a key has leaked.
Reading An App Card
Each connected app has a card showing:
- Its logo and name, and whether it is On or Off.
- What kind of app it is: a Website, a Single-Page App or a Mobile Or Desktop App.
- Who May Use It (see below).
- First Sign-In: whether people are asked before the app sees anything.
- People Using It and when it was Last Used.
- What It Can See: the permissions you gave it, such as name and email.
- When its secret was made.
Everything you can do with the app is in the button at the bottom of the card.
Who May Use It
You choose who may sign in to each app: everyone on your team, or only some departments, job titles, teams or people. You can also let your customers in, all of them or a few. Anyone else who tries is told they don't have access, before the app learns anything about them.
Asking People First
With Ask First, people see what the app will learn about them the first time they sign in to it, and choose Allow or Don't Allow. They are asked again only if the app later wants more. With Pre-Approved, you have decided for everyone and people go straight in. Pre-approve your own company tools; ask first for anything customers use.
Last Used And People
People Using It counts the people who currently let the app sign them in. Last Used is the most recent time any of them did.
People Using An App
Choose People Using It to see each person, what they let the app see, when they allowed it and when they last used it. Revoke signs that one person out of the app. If they are still allowed to use it, they can sign in again.
Rotate The Secret
Websites have a client secret, the app's password. It is shown once, when the app is connected. To make a new one, choose Rotate Secret, pick how long the old secret keeps working (from not at all up to a week) so you have time to paste the new one into the app, then Make A New Secret. The new secret is shown once, with a .env file to download.
Single-page apps and mobile apps have no secret. They prove who they are another way (PKCE) each time.
Sign Everyone Out
Revoke All Sign-Ins signs every person out of the app at once. The app stays connected; people sign in again next time, and are asked first again if the app asks.
Turn An App Off
Disable stops anyone signing in to the app until you choose Turn Back On. Nothing is deleted.
Remove An App
Remove disconnects the app for good and signs everyone out of it. To use it again you would connect it as a new app and paste new values into it.
Related articles
Other guides that answer questions close to this one.
Connect An App
Connecting an app takes seven short steps. Open Settings, then Security, choose Identity & Sign-In, then Connected Apps, and press Connect An App. You need the Manage Connected Apps permission. Nothing is saved until…
Identity And Sign-In
Your organization has its own sign-in page, at login. followed by your domain. This page decides what that sign-in page offers: which ways in, which accounts people can bring with them, and how hard it checks that…
Apps With Access
Your organization can let you sign in to other websites and apps with your organization account, such as a company blog, dashboards or a training site. The first time you do, the app may ask what it can see, and you…