Company Sign-In (SSO)

Company sign-in (single sign-on, SSO) lets the people in your organization sign in with their company account from your own identity provider, instead of a separate OpenBoxes Lift password. It is available now.

Which plans have it#

  • Enterprise: included in the plan.
  • Dedicated: a paid add-on, $299/month on the Dedicated Tier monthly plan or $2,900/year on the Dedicated Tier annual plan.
  • Shared: not available on the Shared Tier. If you need it, you can move to Dedicated and add it, or move to Enterprise.

Supported identity providers#

Company sign-in uses SAML 2.0 or OpenID Connect. It works with:

  • Microsoft Entra ID (formerly Azure AD), over OpenID Connect or SAML
  • Okta
  • Google Workspace
  • Any other identity provider that supports standard SAML 2.0 or OpenID Connect

How it works#

  1. Verify your domain. Your organization proves it owns the email domain (or domains) your people use by adding a DNS TXT record that we give you.
  2. Connect your identity provider. We connect your identity provider to your OpenBoxes Lift account with you, and test it with you before it is turned on.
  3. Sign in with the company account. From then on, people with an address on a verified domain sign in with their company account. That one sign-in covers both the OpenBoxes Lift portal and your OpenBoxes instance.

Getting it set up#

On Dedicated, buy the company sign-in add-on yourself in the portal: go to Billing and click Browse add-ons on the Add-ons card. Add-ons can be bought once your subscription is paid, not during the 30-day trial. On Enterprise it is already included.

The setup itself is done with our team. There is no page in the portal where you switch it on yourself, and buying the add-on does not switch it on. After you buy it (or at any time on Enterprise), email sales@openboxes.cloud (or ask in the portal support chat) and tell us which identity provider you use. If you are not a customer yet, use the Contact Sales form.

Roles from your identity provider's groups#

Company sign-in can set people's roles from the groups they belong to in your identity provider. This is set up with our team too: tell us which group should give which role, and we enter the mappings for you. There is no page in the portal where you edit them yourself.

  • Only for company sign-in. It applies to people who sign in with their company account, each time they do. People who sign in with a password or with third-party sign-in keep the roles you give them on the Users page.
  • Viewer, User, Manager or Admin. Those are the roles a group can give. A group can never make anyone the account owner, never changes the account owner's role, and never gives API access.
  • It raises roles and does not lower them. If a person's groups map to a higher role than the one they have, their role is raised to match. Otherwise nothing changes, so a higher role you set by hand is kept. If you ask us to, we can make your groups decide roles in both directions instead, so a person can also be lowered at their next company sign-in.
  • Admin needs the account owner's agreement. A group can be mapped to Admin only after the account owner allows it in Settings, on the Company sign-in tab, under Admins from company groups. The owner can stop allowing it at any time; anyone who is already an Admin stays an Admin.
  • You can see every change. The role in your OpenBoxes instance follows, and the change appears in Recent team changes on the Users page, labelled Company sign-in.

What it does not do#

  • No user sync (no SCIM). It does not sync users from your identity provider (there is no SCIM). People join your account the first time they sign in with their company account, and removing someone in your identity provider does not remove them here.
  • No setting that requires everyone to use it.

These are different from company sign-in and are available on every plan:

  • Automatic sign-in. Every Lift account signs in once to the Lift portal, and clicking Launch OpenBoxes opens their OpenBoxes instance with no second login. See Automatic Sign-In.
  • Third-party sign-in. Individual accounts can sign up and sign in with Google, Microsoft, or GitHub. That is individual sign-in, not company sign-in. Anyone who has turned on multi-factor authentication (MFA) is asked for their code after a Google, Microsoft or GitHub sign-in too.

Guides

From the blog