Single Sign-On

With single sign-on (SSO), people in your organization log in to ProtoMap through your identity provider, such as Okta or Microsoft Entra ID, using OpenID Connect. Set it up under Settings › Single Sign-On.

Owners connect the identity provider; Owners and Admins manage domains.

1. Verify Your Domains

SSO admits only people whose email is on a domain your organization has proved it owns.

1. Under Domains, click Add Domain and enter your email domain, such as example.com.
2. Create the DNS TXT record ProtoMap shows: named _protomap-verification.<domain>, with the value shown.
3. Click Verify. The domain changes from Pending to Verified once the record is found.

2. Register ProtoMap With Your Identity Provider

In your identity provider, create an OpenID Connect application for ProtoMap, with the Redirect URI that ProtoMap shows. On a self-hosted server, set the server’s address first, since the Redirect URI starts with it.

3. Connect the Identity Provider

Under Identity Provider, enter what your identity provider gives you:

Field	Value
Issuer	The identity provider’s issuer URL.
Client ID	The application’s client ID.
Client Secret	The application’s client secret. Leave it empty for a public client.
Default Role	The role people get when they first log in: Write or Read.

Turn Status on. People on your verified domains can now log in through SSO. ProtoMap creates each person’s account the first time they log in.

Require Single Sign-On

Once a domain is verified, you can set Required to Yes, for everyone but Owners. Then:

• Everyone but Owners must log in through SSO. Owners keep their passwords, so they can still log in if the identity provider fails.
• People join by logging in through SSO, instead of by invitation.
• Removed users stay out until an Owner or Admin lets them back under Removed Users.

While SSO is required, you cannot remove the last verified domain.