Clock Clerk
Start free trial

Workflows

Set up single sign-on

An organization that signs in with email and password can move to its own identity provider, so its people sign in with the accounts they already have: Okta, Google Workspace, or any other provider that speaks OpenID Connect. An administrator sets it up from the Organization tab, tests a sign-in through it, and only then switches it on. Nobody at Clock Clerk has to be asked, and the organization can switch back to passwords. Single sign-on comes with the Starter, Team and Enterprise plans and the trial, not with Free.

Who can do it

An Admin of an organization that signs in with email and password, on a paid plan or its trial, while it is not read-only and not on the live demo. Open the Organization tab and choose Set up single sign-on on the Sign-in card. The setup wizard's last step, How people sign in, shows the same panel under its Okta and Google Workspace cards, starting on that provider.

The Free plan signs in with passwords only. On Free, a test, Switch on and the setup pack are refused with Sign-ins through Okta, Google Workspace, Microsoft or another identity provider are not part of the Free plan, so an administrator moves the organization to a paid plan first, on the Plans page or the Plan & billing card. Any paid plan will do: single sign-on is on Starter, Team and Enterprise alike.

Three things have to be true, and the panel says which one is missing before you start:

Where self-serve is not available, Send the setup pack beneath the panel emails your IT administrator the Okta steps, and support makes the switch instead. Google Workspace has no setup pack: its switch is the test alone.

1. Register Clock Clerk at your provider

Choose your Identity provider: Okta, Google Workspace or Another OpenID Connect provider. Whichever you choose, the panel shows the Redirect URI to register, such as https://acme.clockclerk.com/api/auth/oidc/callback. Add it to the app you create for Clock Clerk exactly as written, with no trailing slash: every sign-in comes back to it, and so does the test.

2. Enter its details

Google Workspace's domain is not entered either: the test learns it from the account Google signs in, and it has to be one of your organization's own domains. Only accounts in that Workspace can sign in once you switch on.

Before you test, the panel says what switching on will do: passwords stop working, and everybody signs in through your provider at the workspace address. Each person is matched by their email address the first time they sign in, so it lists your administrators and their addresses. Anybody whose address at the provider is different from the one they have in Clock Clerk is refused as not invited until the two match, so check those first.

3. Test a sign-in

Choose Test sign-in. Clock Clerk first checks that the issuer publishes its sign-in settings. The browser then moves to your workspace address and on to your provider, where you sign in as yourself. The test runs the same sign-in your people will use, through the same redirect URI. To pass, your provider has to sign in one of your organization's administrators, with their Clock Clerk address on your organization's own domain, and its answer has to be for the client ID you entered. For Google Workspace, sign in with your work account: Google names its Workspace, which has to be on your organization's own domain.

Either way, you come back to the Organization tab. If the test passed, the panel says whom your provider signed in, and for Google Workspace which Workspace, and Switch on can be pressed. If it didn't, the panel says what to fix (see below), and nothing has changed. A test does not change how anybody signs in, and passwords keep working.

4. Switch on

Switch on works for an hour after a test passes, and only for the settings you tested: change a field, or start another test, and you test again. When you press it, Clock Clerk checks once more that nothing the test proved has changed, then switches your organization over:

Switching back to passwords

An organization that switched itself on here can switch back while it still signs in that way. An administrator opens the Sign-in card on the Organization tab and chooses Switch back to passwords, then Switch back now. Everybody is signed out. People then sign in with their Clock Clerk password at the same address, and anybody who never set one uses Forgot password? on the sign-in page. To use the provider again, test and switch on as before.

Where support set up your organization's sign-in, or has changed it since, only support can change it.

Switching back works on every plan, Free included. An organization that signs in through a provider cannot move to Free until it signs in with passwords again: choosing Free is refused with Your organization signs in through its identity provider, and the Free plan signs in with passwords only. Switch back first, then choose Free; a paid plan keeps your provider.

When something goes wrong