Company sign-in (SSO)
With company sign-in, your people sign in to the Gatelion console with your company login instead of a Gatelion password. Any OpenID Connect provider works, for example Microsoft Entra ID, Okta, Google Workspace, Auth0 or Keycloak.
You still invite each person and choose their roles in Gatelion. The company login only proves who they are: nobody gets in just by having an account at your company.
Your company login's multi-factor sign-in replaces Gatelion's second factor. After a company sign-in, Gatelion doesn't ask for its own.
Set it up
You need to be an admin. Open Settings and find Company sign-in. At the top it shows the redirect address to register at your provider. It looks like https://<your Gatelion address>/api/auth/sso/callback.
- Register Gatelion at your provider. In your provider's admin console, add a web application that uses the authorization code flow. Enter the redirect address from Settings exactly as shown, and allow the scopes
openid,profileandemail. Your provider gives you a client id and a client secret. See Provider notes. - Enter the settings and click Save. Fill in Issuer, Client id and Client secret. Save is on the bar that appears at the bottom of the page once you change something. Tick Our company login requires multi-factor sign-in once you've checked that it does. The secret is stored encrypted and never shown again; to keep it when you save other changes, leave the field empty.
- Click Test the settings. Gatelion reads your provider's published settings and says whether they answer.
- Click Try company sign-in. You sign in once at your company login, with the company account that has your own Gatelion email address. You come back to Settings with "Your company login works. You can now allow or require it." The try signs nobody in; it only proves the settings work.
- Choose Company login and click Save. Off; Allowed: company login or password; or Required: company login only (admins keep a password).
To allow or require company login, the Our company login requires multi-factor sign-in box must be ticked.
Required can only be chosen after a successful try, so your organization can't lock itself out. Changing the issuer, the client id or the secret means trying again. To change them while company login is required, switch to Allowed, save, try again, then require it again.
If you try while company login is already allowed, the try signs you in as usual and you land on the console's home page. The settings count as tried all the same.
Every change to these settings is recorded in the audit trail.
Provider notes
Each provider names things differently, and their admin consoles change. These notes point you in the right direction; your provider's own documentation has the details.
| Provider | Issuer | What to register |
|---|---|---|
| Microsoft Entra ID | https://login.microsoftonline.com/<tenant id>/v2.0 | An app registration with a Web platform. Add the redirect address as a redirect URI, then create a client secret. |
| Okta | https://<your domain>.okta.com, or the address of a custom authorization server | An OIDC Web Application app integration, with the redirect address as a sign-in redirect URI. |
| Google Workspace | https://accounts.google.com | An OAuth client of type Web application, with the redirect address as an authorized redirect URI. |
| Others | The address your provider gives as its issuer | A web application (confidential client) using the authorization code flow. |
Your provider publishes its settings at the issuer followed by /.well-known/openid-configuration. If you can open that address in a browser, the issuer is right.
How people sign in
On the sign-in page, people click Sign in with your company login, enter their Work email and click Continue. They go to your company login and come back signed in.
When company login is allowed or required, Settings also shows your organization's sign-in link. It goes straight to your company login, so it works as a bookmark or a tile in your company's app portal.
The first company sign-in links the person's company account to their Gatelion account by email address:
- The email address at your company login must match the one they were invited with.
- Your company login must not say the address is unconfirmed.
After that, Gatelion knows them by their company account, not their email. If their email address changes at your company later, they can still sign in.
An invited person who hasn't accepted yet can simply sign in with the company login. That first sign-in accepts the invitation, and their invitation code stops working.
The People list shows "company login" under the status of everyone who has signed in this way, or "company login or password" if they also have a password.
When company login is required
With Required, members can't:
- sign in with a password: the sign-in page tells them "Your organization signs in with its company login."
- accept an invitation by setting a password
- reset a password: they get no reset email
Admins can still sign in with a password and Gatelion's second factor. That's your way in if your company login is down. An admin who joined through the company login has no password yet: they can set one with Forgot your password? on the sign-in page, even while company login is required. Make sure at least one admin has a password and a working second factor.
People who only sign in with the company login have no Gatelion password and no Gatelion second factor. Their Account page says "You signed in with your company login. Your company manages your password and multi-factor sign-in."
If a company sign-in fails
Gatelion brings the person back to the sign-in page and says why.
| The sign-in page says | What to do |
|---|---|
| Your company login worked, but that account isn't a member of this organization in Gatelion. | An admin invites that email address on Tools & agents → People. |
| Your company login didn't confirm your email address, so Gatelion can't match it to your invitation. | Confirm the address at your company login, or ask your provider's admin. |
| Your Gatelion account is linked to a different company login account. | Happens when someone gets a new account at your company login. An admin opens the person's ⋯ menu on Tools & agents → People and chooses Unlink company login. Their next company sign-in links the company account that has their email address. |
| Your access to Gatelion has been removed. | An admin removed their access. See People and invitations. |
| The company login didn't finish signing you in. | Try again. If it keeps happening, check the settings and the app registration at your provider. |
| Your company login can't be reached right now. | Try again in a moment. |
| That sign-in expired or was started in another browser. | Start again, and finish within 10 minutes in the same browser. |
| Your organization doesn't use a company login in Gatelion. | Company login is off, or the email address isn't a member of an organization. Sign in with a password. |
A person is linked to one account at one company login. If you change the Issuer or the Client id (for example, you move to another provider), every person's link is cleared, and each person's next company sign-in links again by email. Try company sign-in again before requiring it.
When someone leaves
Removing someone at your company login stops their new sign-ins. A console session they already have open keeps working until it's unused for 12 hours.
To cut them off at once, also choose Remove access for them in Gatelion. See When someone leaves.
What company login doesn't cover
- Gatelion's operators. They sign in to their own separate site with their own accounts.
- Your customers. Their agents act for them through your own login, which you set up under customer access. See Your customers' agents.
- Agents. Agents use their tokens, not a sign-in. See Agents and tokens.
Related
- Sign-in security covers passwords, second factors and recovery codes.
- People and invitations covers inviting people, roles and removing access.
- Organizations, environments and roles describes the Settings page.
Still stuck? Contact support from the console.