Skip to main content
Single sign-on lets people use the accounts of the company directory instead of a MoleSignal password. Open Identity & Access → SSO providers and Email domains. Reading the providers and domains requires org.settings.read, and changing them requires org.settings.manage.

​
Before adding a provider

Set [http].external_url to the public address of MoleSignal. The Redirect URI of OIDC and the Assertion consumer URL (ACS) of SAML are derived from it, and the identity provider must call them back. Provider settings are stored in the database and apply without a restart.

​
Add a provider

  1. Open SSO providers and select New provider.
  2. Enter a Name and choose the Kind: OIDC, SAML, or LDAP.
  3. Fill in the settings of the kind.
  4. Map the identity fields and the roles. See Identity field mapping and Role binding.
  5. Select Create provider.
When editing a provider, leave Client secret or Search bind password empty to keep the saved value.

​
Identity field mapping

Identity field mapping tells MoleSignal where to read four fields of a person: A sign-in without a valid email is refused.

​
Role binding

External group → role lists mappings from a value of Groups to a MoleSignal role. Select Add mapping, enter the External group value, for example platform-admins, and choose the role. A person receives the role of every mapping that matches, and the roles are synchronized at each sign-in. Default role applies when no mapping matches. Without it, the role of self-service joining applies.

​
What happens at sign-in

The sign-in page shows a button for each enabled provider. For an LDAP provider, enter the directory user name and password in the form first, then select the button of the provider.
  1. The provider confirms the person, and MoleSignal reads the mapped fields.
  2. A person without a MoleSignal account gets one, when the email passes the email domains of the workspace.
  3. A person who is not yet a member joins the workspace of the provider with the mapped roles, or the default role.
  4. For an existing member, the roles of matching mappings replace the earlier ones. A disabled account cannot sign in.

​
Manage providers

The list shows each provider with its kind, whether it is enabled, and when it changed.

​
Email domains

Email domains limits which email addresses may join the workspace through an invitation or single sign-on. Select Add domain and enter a domain such as example.com. While the list is empty, any address may join. Remove deletes a domain from the list.
Last modified on October 26, 2026