Single sign-on

Sign in with Google, GitHub, any OpenID Connect provider, or SAML 2.0.

Owners add identity providers under Settings → Single sign-on. You can have several, and each one can show a button on the sign-in page.

Agent sign-ins use the same providers. When someone connects Claude Code or Cursor, the browser goes through your SSO.

#Google

1. In Google Cloud Console, create an OAuth client ID of type Web application.
2. Add the Redirect URI shown in Gatehouse, like https://gatehouse.yourcompany.com/auth/<id>/callback.
3. Paste the client ID and secret into Gatehouse.
4. Set Allowed email domains to your Google Workspace domain.

#GitHub

1. In GitHub, go to Settings → Developer settings → OAuth Apps → New OAuth App.
2. Set the callback URL to the redirect URI shown in Gatehouse.
3. Paste the client ID and secret. Gatehouse uses the person's verified primary email.

#OpenID Connect (Okta, Entra ID, Auth0, Keycloak, OneLogin)

Create a web application in your provider with the authorization code flow, register the redirect URI, and enter the Issuer URL, client ID and secret in Gatehouse.

Gatehouse discovers the endpoints, uses PKCE and a nonce, and verifies each ID token's signature, issuer, audience and expiry against the provider's published keys.

#SAML 2.0

Give your identity provider these values, shown on the provider's page in Gatehouse:

• ACS (reply) URL: https://gatehouse.yourcompany.com/auth/saml/<id>/acs
• Entity ID and metadata: https://gatehouse.yourcompany.com/auth/saml/<id>/metadata
• Name ID: email address

Then paste the provider's SSO URL and signing certificate into Gatehouse. Assertions must be signed.

#Allowed email domains

Limit sign-in to emails at your domains, like yourcompany.com. Leave it empty to accept any verified email that already has a Gatehouse account.

#Just-in-time accounts

Turn on Create accounts on first sign-in to let people from allowed domains in without an invite. Pick the role and groups new accounts get. Member is the safe default. Use SCIM if you want accounts and groups managed centrally.

#Groups from sign-in

OpenID Connect and SAML providers can send the person's groups at every sign-in. Gatehouse uses them to keep group membership current without SCIM.

1. In the provider's settings in Gatehouse, set Groups claim: usually groups for OIDC. For ADFS and Entra ID SAML, use http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.
2. Configure your identity provider to include groups in the token or assertion.
3. Open a group in Groups and add a Single sign-on mapping: the provider and the value it sends. Entra ID sends group object IDs, like 7f3c2a10-…. Okta, Keycloak and ADFS can send names.

Optionally turn on Also match groups by name. Each claim value then joins the Gatehouse group of the same name, which is created if it doesn't exist.

At each sign-in, the person joins the groups their claim maps to. They leave any group this provider added before that is no longer in the claim. Memberships added by hand, and groups owned by SCIM or a directory sync, are never changed.

Entra ID stops listing groups in the token when someone is in more than 200 of them. If that applies, use SCIM instead.

#Requiring SSO

Once SSO works, set Password sign-in to Owners only or Off in Security settings.