Single sign-on

Keanan supports sign-in with Google and Microsoft through OpenID Connect. Only people who already have an active account in the workspace can sign in this way; single sign-on never creates accounts. Add people as usual, by invite or CSV import, and they choose how to sign in.

The buttons appear on the login page as soon as a provider is configured. Settings, Workspace, Company sign-in shows which providers are on.

Google Workspace

1. In Google Cloud console, open APIs and services, Credentials and create an OAuth client ID of type Web application.
2. Add the authorised redirect URI https://YOUR-WORKSPACE/api/v1/auth/sso/google/callback/.
3. Set the client id and secret on the server and restart:

SSO_GOOGLE_CLIENT_ID=1234-abc.apps.googleusercontent.com
SSO_GOOGLE_CLIENT_SECRET=...

Microsoft 365 and Entra ID

1. In the Entra admin center, open App registrations, New registration.
2. Choose Web as the platform and add the redirect URI https://YOUR-WORKSPACE/api/v1/auth/sso/microsoft/callback/.
3. Under Certificates and secrets, create a client secret.
4. Set the values on the server and restart:

SSO_MICROSOFT_CLIENT_ID=00000000-0000-0000-0000-000000000000
SSO_MICROSOFT_CLIENT_SECRET=...
SSO_MICROSOFT_TENANT=your-tenant-id

SSO_MICROSOFT_TENANT defaults to organizations, which accepts any work account; set your tenant id to accept only your own directory.

Restricting domains

To accept only company addresses, list the allowed domains:

SSO_ALLOWED_DOMAINS=acme.com,acme.de

How it works

The provider confirms the email address, Keanan matches it to an active account (ignoring case), and a one-time code valid for two minutes hands the session to the browser. Google addresses must be verified. If the address is unknown, the login page says so instead of creating anything.

If the public address of the API differs from PUBLIC_APP_URL, set SSO_CALLBACK_BASE to the address the provider should redirect to.