Single sign-on

Your people can sign in to EyalSec with the identity provider your company already uses, such as Okta, Microsoft Entra ID, Google Workspace, Auth0 or Keycloak. This page shows how to sign in that way, how your IT team sets it up, and what changes when your company makes it the only way in.

On the sign-in page, click Sign in with SSO. Enter your work email and click Continue. Your company's sign-in page opens. Sign in there and you land on your EyalSec dashboard.

You are signed in to the EyalSec account that uses the same email address.
If your account has two-factor authentication on, you still enter your code after your company's sign-in.

Messages you may see:

Message	What to do
Single sign-on is not set up for your domain yet.	Sign in with your password, or ask your IT team to set it up with us.
That sign-in request expired.	Click Sign in with SSO again. A request is valid for 10 minutes.
No EyalSec account uses this address yet.	Ask the person who manages EyalSec at your company to add you.
That account's address is not at your domain.	Sign in to your company's page with your work address.
Your identity provider has not verified your email address yet.	Ask your IT team to verify the address.
Your company signs you in with single sign-on.	Use Sign in with SSO instead of your password or Google.

How setup works

Single sign-on is set up once per email domain, like example.com. Your IT team creates an app for EyalSec in your identity provider and sends us four things at support@eyalsec.com:

Your email domain.
The issuer URL.
The client ID.
The client secret. Send it through a channel you trust, and never in the same message as the client ID.

Every provider needs this redirect URI on the app:

https://eyalsec.com/login/sso/callback

EyalSec uses OpenID Connect with the openid and email scopes. We read only your email address and whether your provider has verified it. Each address must be at your domain; your provider cannot sign anyone in at a different domain.

Okta

Sign in to Okta as an administrator. Open Applications, then Applications, then Create App Integration.
Choose OIDC - OpenID Connect and Web Application, then click Next.
Name it EyalSec. Under Sign-in redirect URIs, enter https://eyalsec.com/login/sso/callback. Keep the Authorization Code grant type.
Under Assignments, choose the people or groups who use EyalSec. Click Save.
On the General tab, copy the Client ID and the Client secret.
Your issuer URL is your Okta address, like https://example.okta.com. If you use a custom authorization server, use its issuer instead, like https://example.okta.com/oauth2/default.

Microsoft Entra ID

In the Microsoft Entra admin center, open App registrations and click New registration.
Name it EyalSec. Under Supported account types, choose Accounts in this organizational directory only.
Under Redirect URI, choose Web and enter https://eyalsec.com/login/sso/callback. Click Register.
On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.
Open Certificates & secrets and click New client secret. Copy the secret's Value right away; it is shown once.
Open Token configuration, click Add optional claim, choose ID, and add email and xms_edov. Accept the prompt to add the email permission. Entra ID uses xms_edov to say it has verified the address's domain, and sign-in is refused without it.
Your issuer URL is https://login.microsoftonline.com/<tenant-id>/v2.0, with your Directory (tenant) ID in place of <tenant-id>. The shared common and organizations addresses do not work, because they accept every tenant.

Each person also needs an email address on their Entra ID user.

Other providers

Any provider that supports OpenID Connect works. Create a confidential web app with the redirect URI above and send us the same four things. The issuer is usually shown on the provider's app page:

Google Workspace: create an OAuth client of type Web application in an Internal project. The issuer is https://accounts.google.com. Only accounts in your Workspace domain can sign in.
Auth0: the issuer is your tenant address with a slash at the end, like https://example.us.auth0.com/.
Keycloak: the issuer is your realm's address, like https://sso.example.com/realms/example.

Make SSO the only way in

When your company asks, we turn on enforcement for your domain. Then accounts at your domain:

cannot sign in with a password or with Google, and see a message pointing to Sign in with SSO;
cannot register a new account with a password;
cannot change their recovery email to an address outside your domain.

When someone leaves, remove them in your identity provider. They can no longer sign in to EyalSec. Their API keys keep working until revoked, so revoke them in API keys or ask us to.

New people

By default, a person needs an EyalSec account before they can sign in with SSO. Ask us to add people, or ask us to turn on automatic accounts for your domain. With automatic accounts, anyone your provider signs in at your domain gets an account on first sign-in. A new account adds machines once a card is on its Billing tab.