> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Configure SAML or OIDC single sign-on for Ravenna with Okta, Entra ID, ADFS, Google Workspace, Keycloak, PingFederate, and custom providers.

Connect your organization's identity provider to enable centralized authentication, enforce security policies, and provide seamless sign-in for your team.

Single Sign-On allows your team to access Ravenna using their existing corporate credentials.

## Supported identity providers

Supports both SAML and OIDC identity providers:

* **Okta**
* **ADFS (Active Directory Federation Services)**
* **Entra ID (Azure AD)**
* **Google Workspace**
* **Keycloak**
* **PingFederate**
* **Custom SAML**
* **Custom OIDC**

## Benefits

<CardGroup cols={2}>
  <Card title="Enhanced security" icon="shield-check">
    Centralized authentication with your organization's security policies
  </Card>

  <Card title="Simplified access" icon="key">
    One set of credentials for all workplace applications
  </Card>

  <Card title="User management" icon="users">
    Provision and deprovision users through your identity provider
  </Card>

  <Card title="Compliance" icon="file-check">
    Meet organizational security and compliance requirements
  </Card>
</CardGroup>

## How SSO works

When your organization has SSO configured, Ravenna automatically detects and redirects users based on their email domain.

### Automatic SSO redirect

When a user enters an email address during login:

1. **Domain detection** - Ravenna checks if the email domain matches an organization with SSO enabled.
2. **Automatic redirect** - If a match is found, the user is immediately redirected to your identity provider.
3. **Authentication** - User authenticates with their corporate credentials.
4. **Authentication response** - IdP sends authentication credentials back (SAML assertion or OIDC tokens).
5. **Access granted** - User is logged in with appropriate permissions.

<Info>
  Users whose email domain matches an SSO-enabled organization are automatically redirected without needing to manually select "Sign in with SSO".
</Info>

<Info>
  Requesters and guests sign in through the same SSO flow as admins and members. After authenticating, they land on the <Tooltip headline="Portal" tip="Self-service home where end users submit and track requests" cta="Learn about the Portal" href="/documentation/platform/portal/requesters">Portal</Tooltip> rather than the Admin.
</Info>

### Manual SSO access

Users can also manually initiate SSO by clicking "Sign in with SSO" on the login page, which is useful for:

* Testing SSO configuration
* Accessing specific organizations when you have multiple accounts
* Bypassing automatic redirect if needed

### Direct SSO login URL

Organizations with SSO enabled receive a direct login URL with a `connection` parameter:

```text theme={"system"}
https://app.ravenna.ai/login?connection=<connection-name>
```

This URL provides one-click SSO access. Users are immediately redirected to the identity provider without entering their email. Configure this URL in your IdP's app portal (Okta, Entra ID, Google Workspace, JumpCloud) to give users seamless access to Ravenna.

<Callout icon="link" color="#6B7280">Learn more about [configuring the direct SSO login URL](/integrations/sso/setup#direct-sso-login-url)</Callout>