Set Up Single Sign-On

The setup connects your company's identity provider to Kamo in six steps. Open Settings, then Security, choose Identity & Sign-In, then Identity Providers, and press Add An Identity Provider. You need the Manage Identity Providers permission.

Nothing changes for anyone until the very last button, Save And Turn On. You can stop at any step with Save And Finish Later or by closing the window; the connection waits on its card with Continue Setup.

Set Up Single Sign-On

The six steps are shown across the top. A finished step gets a tick, and you can go back to any step you have already reached.

1. Pick your provider.
2. Copy Kamo's details into it.
3. Tell Kamo about it.
4. Match up the details.
5. Run a test sign-in.
6. Choose who signs in this way, and turn it on.

Step 1: Pick Your Provider

Pick the system your company keeps its work accounts in. If yours isn't listed, choose Another OpenID Connect Provider or Another SAML Provider: almost every provider speaks one of the two.

The Name is what people see on the sign-in button, as in "Continue With Contoso". It starts as the provider's name; you can use your company's own.

OpenID Connect Or SAML

Many providers speak both. Both are safe.

• OpenID Connect is quicker to set up: an address, an id and a secret. It is recommended.
• SAML is the older standard many companies already use. It uses a metadata file or address.
• Choose SAML if whoever runs your provider prefers it. You can change it later while the connection is off.

Step 2: Copy Kamo’s Details Into Your Provider

Your provider has to be told where to send people back after they sign in.

• OpenID Connect: add every Redirect Address shown to your provider's list of allowed redirect addresses. There is one for each address your sign-in page can be reached at.
• SAML: give your provider the Entity ID and the Reply Address (ACS URL), or the Service Provider Metadata address if it can read one.

Each value has a copy button. Beside them are short steps for where to paste them in your provider. The menus may have moved a little; the names are what to look for.

Step 3: Tell Kamo About Your Provider

• OpenID Connect: paste the Discovery Address (it ends in /.well-known/openid-configuration), the Client ID and the Client Secret. Google Workspace and JumpCloud fill in the discovery address for you.
• SAML: paste the Metadata Address, or press Upload A Metadata File. You can also Enter The Details By Hand: the provider's entity id, sign-in address and signing certificate.

Press Read Settings. Kamo saves what you typed, reads your provider, and shows what it found as cards on the right — the provider's address, where it signs people in, its signing keys or certificates and when they expire. Each turns green once it is found. The secret is stored encrypted and never shown again.

When The Client Secret Expires

Most providers make client secrets that stop working after a while. Enter the date and Kamo warns you a month before. Leave it empty if your secret never expires.

Scopes

Under More Settings. Which details Kamo asks your provider for. The standard openid email profile is enough for almost everyone; some providers need groups added before they send group names.

Metadata

A SAML provider publishes its settings, including the certificate it signs with, as a metadata file. An address is best: Kamo re-reads it on its own, so a renewed certificate is picked up without anyone doing anything. An uploaded file is read once; upload a new one when the certificate is renewed.

Sign-In Started From The Provider

SAML only. Off (the default) means people always start from your sign-in page, which protects them against a forged sign-in being pushed at them. Turn it on only if your people open Kamo from your provider's own app list.

Step 4: Match Up The Details

Your provider sends details about each person: their email address, name, job title, department and groups. On the left is what your provider sends — after a test sign-in, with the real values. On the right are Kamo's fields.

Drag a detail onto a field, or tap the detail and then tap the field. A field can list several details; it takes the first one that has a value. Remove one with its cross. Most providers need no changes here: the usual details are already matched.

Press Try A Sign-In to run a quick test and see the real values without leaving the step.

Groups, Roles And Teams

Each rule says: people in this group get this Security Role, this Department, this Job Title and these Teams. Type the group's name, or drag it from the groups your last test sent.

• A person in several groups gets the teams of all of them. For the role, department and job title, the first rule that names one wins.
• Kamo only ever changes the roles and teams some rule mentions. Anything you give people by hand stays.
• Example: "Sales" gets the Loan Officer role, the Sales department and the West Region team.

Match By Name

• Match Departments By Name: when your provider sends a department name, such as "Sales", the person goes into your department with that name.
• Match Job Titles By Name: the same for job titles.
• Off: only the group rules set them.

Official Title

Use The Provider’s Title As The Official Title shows the exact title your provider sends, such as "Senior Loan Officer, West", on the person's profile. Off: Kamo leaves official titles alone.

Step 5: Run A Test Sign-In

Press Start Test. Your sign-in page opens in a small window and sends you to your provider. Sign in there with a work account that should be able to get in, then come back: the result appears on its own.

The result reads like a sentence — "Maria Lopez would sign in as Loan Officer in Sales, on 2 teams" — followed by each check Kamo made with a tick or a cross. A test goes through every check a real sign-in does, then stops: nobody is signed in and nothing is saved.

If it didn't pass, the card says what went wrong in everyday words, such as "The answer was made for a different application. Check the client id." Fix it and press Test Again. Run a test again after any change to the provider's details.

Step 6: Who Signs In This Way

Choose the domains, whether the connection is optional or required, and what happens to new people.

Domains

People whose email address is on these domains are sent straight to your provider when they type it on the sign-in page. Only domains you have proved you own are offered, so nobody can route your people through a provider they don't control. If you haven't verified a domain yet, press Verify A Domain. Without a domain, people can still use the button on your sign-in page.

Optional Or Required

• Optional: people can use the provider or their password.
• Required For These Domains: people on the chosen domains must use the provider.
• Required For Everyone: everyone must.

The Required choices stay locked, with the reason, until a test sign-in has passed and someone on the Emergency Access list has two-step verification or a passkey. Required For These Domains also needs at least one verified domain chosen.

Trust The Provider’s Two-Step Check

On: when your provider confirms it already asked for a second step (a code, an app or a security key), Kamo doesn't ask again. Off: people who have two-step verification in Kamo are still asked for it.

New People

Add New People When They First Sign In — on: a person with a work account on your verified domains who isn't in Kamo yet is added the first time they sign in, as a team member, with the details and rules you matched up. Off: only people already in your organization can sign in this way.

Active Or Waiting For Approval

• Active: new people can work straight away.
• Waiting For Approval: they appear in your organization but can't sign in until someone approves them.

Default Role

The security role a new person gets when no group rule gives them one.

Keep Details Up To Date

On: every time someone signs in, their job title, department, role and teams are updated from your provider. Off: they are set only when someone is first added.

Emergency Access

The same list as on the Identity Providers page: the people who can still sign in with their password if your provider goes down. See Identity Providers.

Turn It On

Save And Turn On saves your choices and turns the connection on. It needs a test that passed. Save And Finish Later saves without turning it on. Once a connection is on, the button reads Save Changes.