This allows your users to log in with an existing account at one of our supported Identity Providers without having to create a new awork account with a new password.

The list of supported identity providers includes:

If you can' t find your identity provider in this list, please contact us directly, and we' ll check if we can provide a connection.

☝️Note: SSO is only available in the awork Enterprise plan.

SAML 2.0 is not supported by awork, as we have opted for the more modern OpenID-Connect Standard based on OAuth 2.0.

Supported identity providers

Setup

  1. Navigate to Settings > Integrations

  2. Open the Integration library and select your provider

  3. Now you need to enter the subdomain, client ID and client secret of the provider in the window. Instructions on how to register awork as an SSO application with your provider can be found below.

Important notes for the setup

The following redirect URLs must be enabled:

https://app.awork.io/enterprise-loginhttps://app.awork.io/api/v1/accounts/authorize-slackhttps://app.awork.io/api/v1/accounts/external/{name of login provider}https://app.awork.io/api/v1/accounts/msteams/authorizehttps://app.awork.io/api/v1/accounts/authorize

For login via web interface, e.g. via https://app.awork.io, you'll need:

https://app.myhq.io/enterprise-login

For authorization from Slack you need:

https://app.awork.io/api/v1/accounts/authorize-slack

For Microsoft Teams authorization you need:

https://app.awork.io/api/v1/accounts/msteams/authorize

For Zapier integrations, you'll need the following redirect URL:

https://app.awork.io/api/v1/accounts/authorize

Below you'll find an overview of specific configurations per Identity Provider.

Okta

  1. Open the Okta configuration at YOUR-SUBDOMAIN.okta.com/admin

  2. Go to the Applications section in the menu

  3. Add a new application and name it e.g. awork

  4. In the details of the application you get Client-ID, Client-Secret, and Subdomain. Enter them in the awork configuration window and finish the configuration by clicking the Save button

☝️Hint: Note here that the login redirect URIs must be set correctly. Otherwise, Okta won't be able to redirect your users properly. In addition, the Implicit (Hybrid) flow, including the ID Token grant type, must be enabled. User consent is not needed as awork only accesses the user's name and email at login.

In the Login section of the Okta application, set the following URIs:

  1. Initiate login URI:

    AWORK_SUBDOMAIN.awork.io/login
  2. Login redirect URIs

    https://app.awork.io/enterprise-login
    https://app.awork.io/api/v1/accounts/authorize-slack
    https://app.awork.io/api/v1/accounts/external/okta
    https://app.awork.io/api/v1/accounts/msteams/authorize
    https://app.awork.io/api/v1/accounts/authorize

Auth0

  1. Open the Auth0 configuration

  2. Go to the Applications section in the menu.

  3. Add a new application with the type Regular Web Applications and name it e.g. awork.

  4. In the details of the application you'll find the Client-ID, Client-Secret and Subdomain. Enter them in the awork configuration window and save.

  5. Set the following URIs in the Application URIs section of the Auth0 configuration

    1. Application login url:

      AWORK_SUBDOMAIN.awork.io/login
    2. Allowed callback URIs

      https://app.awork.io/enterprise-login,
      https://app.awork.io/api/v1/accounts/authorize-slack,
      https://app.awork.io/api/v1/accounts/external/auth0,
      https://app.awork.io/api/v1/accounts/msteams/authorize,
      https://app.awork.io/api/v1/accounts/authorize
    3. Allowed web origins:

      AWORK_SUBDOMAIN.awork.io
      app.awork.io

☝️Hint: All other settings are already set correctly by default.

OneLogin

  1. Open the OneLogin configuration under SUBDOMAIN.onelogin.com

  2. Go to the Applications section in the menu.

  3. Add a new application by clicking the Add App button in the upper right corner and name it e.g. awork.

  4. Select OpenID Connect (OIDC) as type and set the name to e.g. awork and save.

  5. In the SSO section of the app you get client ID and client secret. You can find the subdomain in the URL of your OneLogin account: {subdomain}.onelogin.com. Enter this information in the awork configuration window and save.

  6. The following URIs have to be enabled in the Configuration section, so that the forwarding of your employees works without problems:

    1. Login url:

      AWORK_SUBDOMAIN.awork.io/login
    2. Redirect URIs

      https://app.awork.io/enterprise-login
      https://app.awork.io/api/v1/accounts/authorize-slack
      https://app.awork.io/api/v1/accounts/external/onelogin
      https://app.awork.io/api/v1/accounts/msteams/authorize
      https://app.awork.io/api/v1/accounts/authorize

Azure

  1. Open the Azure AD configuration at portal.azure.com.

  2. Go to the Azure Services section and then Azure Active Directory.

  3. In the Manage section of the menu, click App Registries.

  4. Add a new registry and name it awork, for example.

  5. In the Certificates and Secrets section of the new registry, you'll be able to create a new application ID (client), whose ID (client ID) and value (client secret) you can enter in the awork configuration window.

  6. In the Authentication section, check ID tokens in Azure configuration and set the following redirection URIs for a web platform:

    1. Umleitungs-URIs

      https://app.awork.io/enterprise-login
      https://app.awork.io/api/v1/accounts/authorize-slack
      https://app.awork.io/api/v1/accounts/external/azure
      https://app.awork.io/api/v1/accounts/msteams/authorize
      https://app.awork.io/api/v1/accounts/authorize
  7. Die Subdomain, die du in awork eintragen musst, ist entweder:

GSuite

To set up SSO with GSuite, you need to follow these instructions:

  1. Go to https://console.cloud.google.com/apis/credentials and first select your project for which you want to use SSO

  2. Then click on Create Credentials and select OAuth Client ID from the list

  3. Select Web Application as the type

  4. As a name you'll be able to choose e.g. awork.

  5. In the URIs section you need to add the following URIs:

    1. https://app.awork.io/enterprise-login
      https://app.awork.io/api/v1/accounts/authorize-slack
      https://app.awork.io/api/v1/accounts/external/gsuite
      https://app.awork.io/api/v1/accounts/msteams/authorize
      https://app.awork.io/api/v1/accounts/authorize

  6. After that you save your data via the button Create.

  7. On the right side you will find the client ID and the client key (client secret), which you have to enter in awork

More information about SSO with GSuite can be found here.

After the setup

If the configuration was successful, the SSO sign-in is now available in the login area.

☝️Hint: Rights, users, or groups are currently not controlled via the identity provider. Only the login for existing user accounts is enabled. A user must, therefore, already exist in awork. User matching is done via the user's email address.

Disable other login options

If SSO is configured, it is possible to disable and hide the other login options (email & password as well as social login via. Google & Apple). You can set this up in Settings > General.

This is only advisable if no external users, who are not managed via Identity Management, are working in the workspace.

☝️Hint: If you remove the SSO settings in awork, the login with email and password will be automatically enabled again, so you'll be able to always login with your admin account.

Log in via SSO via app.awork.io

To login via SSO using the global login page app.awork.io, select the option Sign in via SSO.

Here you have to enter the subdomain of your workspace first. After entering the subdomain you will be automatically redirected to the SSO login screen or, if you are already logged in here, directly to your awork dashboard.

If you have disabled the options to login via email & password and/or social login (Google & Apple), they will still be displayed on the global page.

They will just be hidden under the specific workspace page YOUR-WORKSPACE-SUBDOMAIN.awork.io.

However, login will not be possible from the global page either.

Log in via SSO using YOUR-WORKSPACE-SUBDOMAIN.awork.io

If SSO is configured, there is now another selection button Sign in via SSO.

You will now be automatically redirected to the SSO login screen or, if you are already logged in here, directly to your awork dashboard.

Did this answer your question?