Single sign-on
Let members sign in to Proliferate Cloud through your OIDC identity provider.
Organization SSO lets members sign in to Proliferate Cloud through your identity provider, alongside GitHub sign-in.
Proliferate Cloud speaks OIDC (OpenID Connect), so it works with any compliant provider, including Google, Okta, Microsoft Entra ID, Auth0, GitLab, and others. The settings screen shows and manages a single SSO connection per organization, scoped to one or more allowed email domains.
Invite-first. Connections created from the settings screen have just-in-time provisioning turned off, so the normal Cloud flow is to invite a person to the organization first (Members & roles); they can then sign in through SSO. Enabling SSO adds a sign-in path — it does not force members to use it and does not replace GitHub sign-in.
Auth paths
| Path | Use it when |
|---|---|
| GitHub sign-in | The default sign-in for Proliferate Cloud. Most teams start here. |
| Organization SSO (OIDC) | You want an org-level sign-in tied to your identity provider and email domains, on top of GitHub sign-in. |
| Self-hosted auth | Your org runs a self-hosted deployment and configures its own login backend (GitHub OAuth, Google OAuth, email + password, or OIDC SSO). |
Set up SSO
Field-by-field OIDC connection setup and the Draft → test → Enable lifecycle.
Roll out SSO to members
The four ways members reach your identity provider once SSO is enabled.
Troubleshooting
Redirect URI, domain, and token-exchange fixes.
Self-hosted SSO
Configure SSO with environment variables on a self-hosted deployment.
SCIM directory sync (automated user provisioning and deprovisioning) is not available yet.
For provider-specific setup, see the guides for Google, Okta, Microsoft Entra ID, Auth0, and GitLab.