--- title: "Set up single sign-on — Clock Clerk user guide" description: "How an administrator moves an organization that signs in with email and password to its own Okta, Google Workspace or other OpenID Connect provider: the app to register, the test sign-in, switching on, and switching back." url: "https://clockclerk.com/guide/workflows/set-up-single-sign-on" --- Workflows # Set up single sign-on An organization that signs in with email and password can move to its own identity provider, so its people sign in with the accounts they already have: Okta, Google Workspace, or any other provider that speaks OpenID Connect. An administrator sets it up from the Organization tab, tests a sign-in through it, and only then switches it on. Nobody at Clock Clerk has to be asked, and the organization can switch back to passwords. Single sign-on comes with the Starter, Team and Enterprise plans and the trial, not with Free. ## Who can do it An [Admin](https://clockclerk.com/guide/roles.md) of an organization that signs in with email and password, on a paid plan or its trial, while it is not read-only and not on the live demo. Open the [Organization](https://clockclerk.com/guide/screens/admin-organization.md) tab and choose **Set up single sign-on** on the Sign-in card. The setup wizard's last step, **How people sign in**, shows the same panel under its **Okta** and **Google Workspace** cards, starting on that provider. The Free plan signs in with passwords only. On Free, a test, **Switch on** and the setup pack are refused with [*Sign-ins through Okta, Google Workspace, Microsoft or another identity provider are not part of the Free plan*](https://clockclerk.com/guide/troubleshooting/messages.md), so an administrator moves the organization to a paid plan first, on the [Plans](https://clockclerk.com/guide/screens/trial.md) page or the Plan & billing card. Any paid plan will do: single sign-on is on Starter, Team and Enterprise alike. Three things have to be true, and the panel says which one is missing before you start: - Your deployment can give your organization a workspace address of its own, such as `acme.clockclerk.com`. It is assigned from your organization's domain unless it already has one, and your people sign in there afterwards. - At least one administrator has their Clock Clerk address on a domain your organization has proved it owns, such as the one it signed up with. Only such an administrator's sign-in can prove that the provider is your organization's. - No other Clock Clerk organization signs in through the same provider. For Google Workspace, that means the same Workspace domain, which also has to be one of your organization's own. Where self-serve is not available, **Send the setup pack** beneath the panel emails your IT administrator the Okta steps, and support makes the switch instead. Google Workspace has no setup pack: its switch is the test alone. ## 1. Register Clock Clerk at your provider Choose your **Identity provider**: **Okta**, **Google Workspace** or **Another OpenID Connect provider**. Whichever you choose, the panel shows the **Redirect URI to register**, such as `https://acme.clockclerk.com/api/auth/oidc/callback`. Add it to the app you create for Clock Clerk exactly as written, with no trailing slash: every sign-in comes back to it, and so does the test. - **Okta**: the panel lists the steps, the same ones the emailed setup pack has. Create an OIDC app integration with the **Authorization Code** grant and the redirect URI, and assign it to the people who will use Clock Clerk. If your issuer is a custom authorization server, such as `https://acme.okta.com/oauth2/default`, one of its access policies (**Security → API → Authorization Servers**, then **Access Policies**) has to be assigned to this app, or to **All clients**, with a rule that allows **Authorization Code**. Without it, Okta turns everyone away just after they sign in, with “You are not allowed to access this app”. A **Single-Page Application** needs no secret; a **Web Application** has a client secret, which you enter too. - **Google Workspace**: in Google Cloud console, create an **OAuth client ID** of type **Web application** with the redirect URI as an **Authorized redirect URI**, and set the consent screen's audience to **Internal**. The panel lists the steps, and [Signing in with Google Workspace](https://clockclerk.com/guide/workflows/set-up-your-organization.md) has them too. - **Another OpenID Connect provider**: create a web app or client that uses the authorization code flow, with the redirect URI, and the standard `openid`, `email` and `profile` scopes. The provider has to say that each person's email address is verified. ## 2. Enter its details - **Issuer**: the https address your provider names itself by. For Okta, your authorization server's Issuer URI, under Security → API in the Okta Admin Console, such as `https://acme.okta.com/oauth2/default`; if your Okta has no API item there, your Okta address on its own, such as `https://acme.okta.com`. Google Workspace has none to enter. - **Client ID**: the app's client ID, exactly as the provider shows it. - **Client secret**: the app's secret, if it has one. Google Workspace always needs it. It is kept encrypted and never shown again, so enter it again whenever you test again. Google Workspace's domain is not entered either: the test learns it from the account Google signs in, and it has to be one of your organization's own domains. Only accounts in that Workspace can sign in once you switch on. Before you test, the panel says what switching on will do: passwords stop working, and everybody signs in through your provider at the workspace address. Each person is matched by their email address the first time they sign in, so it lists your administrators and their addresses. Anybody whose address at the provider is different from the one they have in Clock Clerk is refused as not invited until the two match, so check those first. ## 3. Test a sign-in Choose **Test sign-in**. Clock Clerk first checks that the issuer publishes its sign-in settings. The browser then moves to your workspace address and on to your provider, where you sign in as yourself. The test runs the same sign-in your people will use, through the same redirect URI. To pass, your provider has to sign in one of your organization's administrators, with their Clock Clerk address on your organization's own domain, and its answer has to be for the client ID you entered. For Google Workspace, sign in with your work account: Google names its Workspace, which has to be on your organization's own domain. Either way, you come back to the Organization tab. If the test passed, the panel says whom your provider signed in, and for Google Workspace which Workspace, and **Switch on** can be pressed. If it didn't, the panel says what to fix (see below), and nothing has changed. A test does not change how anybody signs in, and passwords keep working. ## 4. Switch on **Switch on** works for an hour after a test passes, and only for the settings you tested: change a field, or start another test, and you test again. When you press it, Clock Clerk checks once more that nothing the test proved has changed, then switches your organization over: - Everybody's sessions end, yours included, and passwords stop working. - You are taken to your workspace address to sign in through your provider, which usually does not ask again. - Everybody else signs in there too, and is matched by their email address the first time. - For Google Workspace, only accounts in the Workspace the test named can sign in, and the Sign-in card names it under **Google Workspace domain**. - Support is told, so they know your organization signs in its own way now. Nothing is asked of you. ## Switching back to passwords An organization that switched itself on here can switch back while it still signs in that way. An administrator opens the Sign-in card on the Organization tab and chooses **Switch back to passwords**, then **Switch back now**. Everybody is signed out. People then sign in with their Clock Clerk password at the same address, and anybody who never set one uses **Forgot password?** on the sign-in page. To use the provider again, test and switch on as before. Where support set up your organization's sign-in, or has changed it since, only support can change it. Switching back works on every plan, Free included. An organization that signs in through a provider cannot move to Free until it signs in with passwords again: choosing Free is refused with [*Your organization signs in through its identity provider, and the Free plan signs in with passwords only.*](https://clockclerk.com/guide/troubleshooting/messages.md) Switch back first, then choose Free; a paid plan keeps your provider. ## When something goes wrong - [Clock Clerk couldn’t read the sign-in settings … publishes](https://clockclerk.com/guide/troubleshooting/messages.md): the issuer is mistyped, or is not your provider's. - [The test sign-in didn’t pass](https://clockclerk.com/guide/troubleshooting/messages.md): the provider refused the sign-in, the client ID or secret is wrong, the redirect URI is not registered exactly as shown, or you are not assigned to the app. - [Your identity provider signed you in as …](https://clockclerk.com/guide/troubleshooting/messages.md): sign in as an administrator whose address there matches their Clock Clerk address on your own domain. - [… without an email address it vouches for](https://clockclerk.com/guide/troubleshooting/messages.md): grant the app the email scope, and give the account a verified address. - [Google signed you in with an account that isn’t in a Google Workspace](https://clockclerk.com/guide/troubleshooting/messages.md): test again with your work account in your organization’s Workspace, not a personal Gmail account. - [… whose domain isn’t one your organization has proved it owns](https://clockclerk.com/guide/troubleshooting/messages.md): test with an account of your own Workspace, or ask support to add its domain to your organization. - [That Google account isn’t in your organization’s Google Workspace](https://clockclerk.com/guide/troubleshooting/messages.md): after switching on, sign in with an account in the Workspace your test named, the **Google Workspace domain** on the Sign-in card. - [This sign-in test has expired …](https://clockclerk.com/guide/troubleshooting/messages.md): start the test again from the Organization tab. - [Test a sign-in through these settings first](https://clockclerk.com/guide/troubleshooting/messages.md): the hour passed, or something the test proved has changed since. Test again.