Single Sign-On
Single sign-on (SSO) lets your people sign in to GPCN™ (Global Private Cloud Network™) with your own identity provider instead of a GPCN™ password. You connect a provider, prove you own an email domain, and anyone on that domain is sent to your provider to log in.
Prerequisites
- The
ssofeature enabled for your organization — check Organization → Account → Features - The Tenant Administrator role. Single sign-on is administrator-only: other roles cannot view or change providers at all
SSO administration is a Tenant Administrator capability. The sso permissions aren't held by Tenant Manager, Tenant Operator, or Tenant Viewer, so this is one area where Tenant Administrator stands alone.
Find it at Identity & Access → People → Single Sign-On.
Connect a provider
- Go to Single Sign-On and click Add SSO Provider.
- Enter your provider's configuration. Both OIDC and SAML providers are supported.
- Add the email domain your people sign in with.
- Verify the domain — see below.
Verify your domain
Before GPCN™ will send anyone to your provider, you have to prove you control the domain. GPCN™ gives you a DNS record to publish:
| Field | Value |
|---|---|
| Record type | TXT |
| Name | _gpcn-sso.<your-domain> |
| Value | gpcn-sso-verification=<token from the portal> |
Publish it, then verify from the portal.
A domain can be claimed by one provider across all of GPCN™, so two organizations can't federate the same domain.
Keep the record published. GPCN™ re-checks it periodically, and if it disappears for long enough the domain is revoked — which stops your people signing in through your provider.
What changes for the people in your organization
Signing in
Sign-in starts with an email address alone. If the address is on your verified domain, the person is redirected to your identity provider and never sees a GPCN™ password field.
Accounts are created on first sign-in
Someone signing in through your provider for the first time doesn't need an invitation — GPCN™ creates their account, adds them to your organization, and gives them the Tenant Viewer role. Adjust their role afterwards from Users.
The email your provider asserts has to be on the verified domain, so your provider can't create accounts for addresses outside it.
If you'd rather approve people yourself rather than have accounts created automatically, ask GPCN™ support about disabling automatic sign-up for your provider.
Two-factor authentication
By default GPCN™ still asks for a second factor after your provider has authenticated someone, because it doesn't assume your provider enforced one.
If your identity provider already enforces MFA and you'd rather not double up, GPCN™ can trust it — that's a separate feature on your organization, so raise it with support.
Password sign-in stops working
This is the part worth communicating before you switch it on.
Once a person is governed by SSO, GPCN™ blocks password sign-in and password reset for them. Their old password is retained but won't work, and the reset flow refuses with a message explaining that the account uses single sign-on.
That means an identity provider outage locks your people out of GPCN™. There's a fallback feature your organization can be granted that permits password sign-in for SSO-governed users — worth arranging before you need it. Contact support.
Remove a provider
Deleting your organization's last active provider returns everyone to normal GPCN™ password sign-in, and GPCN™ emails a password reset link to the people who were governed by it. Removing one provider while others remain doesn't change anything for the domains those others cover.
Next Steps
- Users → — adjusting roles for people created by first sign-in
- Roles and Permissions → — what the Tenant Viewer role can do
- Sign In → — the sign-in experience your people will see
- Two-Factor Authentication → — how the second factor works
.png)