Enable single sign-on (SSO)

Enable single sign-on to allow users to authenticate once and access all applications in your workspace without reauthenticating.

Enable SSO

1. In the target workspace, from the left sidebar, go to Authentication > Settings > Persistence.

2. Select the Persistent Session (SSO mode) option.

   

3. Configure the following settings:

   Setting	Description
   Session Max Age	Set the time after which a user's session expires, requiring reauthentication.
   Session Max Idle Time	Define the time after which an inactive session expires, requiring reauthentication.
   SSO cookie domain	Set the domain for the SSO cookie to enable SSO across multiple subdomains. For example, setting .company.com allows SSO to work across app.company.com, portal.company.com, and other subdomains. If empty, it uses the authorization server's domain. When set, this domain is also allowed for logout redirects.
   Level of assurance threshold	Set the minimum confidence level required for authentication. If a user's LOA falls below this threshold, they must verify their identity with a second factor. See Configure the Level of Assurance (LOA) threshold for guidance on choosing a threshold level.

Result: After logging into an application through SecureAuth, users can access all workspace applications without reauthenticating, as long as the session remains valid.

When users sign in again

A valid session is not reused in every case. Users authenticate again when any of the following applies:

Condition	Description
The session expired	The session passed its Session Max Age or Session Max Idle Time.
The application asked for it	The request to /authorize includes prompt=login or max_age=0.
The request names a different user	The request to /authorize includes a login_hint that does not match the signed-in user.

The login_hint check applies only when the session belongs to an identity pool user. SecureAuth compares the hint against every identifier that user has, such as an email address or a username, so passing one identifier when the user signed in with another still reuses the session.

If the session was established through an identity provider that does not provision the user into an identity pool, SecureAuth cannot confirm which user the hint names, and reuses the session as before. To require reauthentication in that case, send prompt=login instead.

Configure logout settings

Control where users can be redirected after logout to prevent open redirect attacks.

For more about logout security and use cases, see Persistent user sessions.

1. In Authentication > Settings, select the Logout tab.

   

2. Configure the following settings:

   Setting	Description
   Allowed Logout Redirect Domains	List domains where applications can redirect users after logout. These domains are valid only if the redirect_to parameter is included in a request to the /authorize endpoint.
   Post-Logout Redirect URL	Set a default URL to redirect users after logout if the application request doesn't include a redirect_to parameter.