Identity Providers

If your company already keeps its work accounts in Microsoft Entra ID, Okta, Google Workspace, JumpCloud, OneLogin, Ping Identity, Auth0, Keycloak, AD FS or any other provider that speaks OpenID Connect or SAML, you can connect it to Kamo. Your people then sign in to Kamo with the work account they already have, and when someone's work account is switched off, they can no longer get into Kamo either. This is often called single sign-on.

Identity Providers

Open Settings, then Security, choose Identity & Sign-In, then Identity Providers. You need the Manage Identity Providers permission. Administrators have it already.

Each connection you add appears as a card. Nothing about how anyone signs in changes until you turn a connection on. Press Add An Identity Provider to start the setup, which takes six short steps (see Set Up Single Sign-On).

An organization can have up to ten connections, for example one for staff in Microsoft and one for a partner company in Okta.

Reading A Connection Card

Each card shows, from top to bottom:

• The provider's logo and the connection's name: the name people see on the Continue With button.
• Whether it is Being Set Up, Ready To Turn On (a test sign-in has passed), On or Off.
• Its Health and whether it is Optional or Required (see below).
• When its signing certificate and its client secret run out.
• When someone last signed in with it, and when it was last tested.
• The domains it covers.
• Recent Problems, in plain words.

The button at the bottom does what the connection needs next: Continue Setup while it is being set up, Edit once it is on. The arrow beside it holds everything else: Run A Test Sign-In, Check It Now, Connection Details, Turn On or Turn Off, and Remove.

Health

Kamo reads each provider's settings and signing keys every few hours.

• Working Well: everything was read and nothing expires soon.
• Needs Attention Soon: a certificate or the client secret runs out within 30 days.
• Not Working: the provider's settings couldn't be read, or a certificate or secret has expired. People can't sign in with it until it is fixed.
• Not Checked Yet: the connection is new.

Everyone who can manage identity providers gets a notification when a connection needs attention, once for each problem. Check It Now reads the provider again straight away.

Certificates And Secrets

Providers sign their answers with a certificate, and OpenID Connect providers also give Kamo a client secret. Both run out eventually.

• The ring beside each date empties as the date gets closer: full a year out, amber inside 30 days, red once it has passed.
• Certificates are read from the provider itself. A provider that renews its own keys, like most OpenID Connect providers, shows Renewed by the provider.
• Kamo can't read when a client secret expires, so you enter that date on step 3 of the setup. If you don't, the card says No expiry date entered.
• Example: Microsoft Entra ID secrets expire after six or twelve months. Enter the date and Kamo warns you a month before, so sign-in never stops by surprise.

Last Sign-In

When someone last signed in successfully with this connection. Nobody yet is normal for a connection that isn't on yet.

Recent Problems

Anything that went wrong lately, in plain words: the provider's settings couldn't be read, a certificate is about to run out, or the last test sign-in didn't pass. Nothing has gone wrong lately means all is well.

Optional Or Required

• Optional: people can use the provider or their password. Start here.
• Required For Its Domains: anyone whose email address is on the domains the connection covers must sign in with the provider. Their password no longer works on its own.
• Required For Everyone: everyone in your organization must sign in with the provider.

The people on the Emergency Access list can always sign in with their password, so a provider outage never locks you out.

Turn A Connection Off

Turn Off hides the connection from the sign-in page straight away. Everyone keeps their account and signs in with their password or another way instead. If the connection was Required, passwords work again. You can turn it back on at any time without setting it up again.

Remove A Connection

Remove deletes the connection and its settings. Nobody loses their account or their membership. Turn a connection off before removing it.

Emergency Access

The people who can still sign in with their password if your identity provider ever stops working. Your organization's owners are always on the list. Press Add People to add others, such as a second administrator.

Before any connection can be made Required, at least one person on the list needs two-step verification or a passkey, so that a stolen password alone could never be used to get in this way. The list shows Two-Step On, Passkey or No Second Step Yet beside each person.

• Example: the owner and the IT manager are on the list, both with an authenticator app. If Okta has an outage, either of them can still sign in and switch the connection to Optional.

Connection Details

Connection Details shows everything Kamo read from the provider: its address, where it signs people in, how many signing keys or certificates it has and when they expire. It also lists the addresses your provider needs to know about Kamo, each with a copy button, in case you need to paste them again.