# Set up Single-Sign On (SSO)

### What you'll need

* In Bird, a user with either the Organization Owner or Owner role.
* Access to setup an application/integration in your Identity Provider.
* Access to your domain's DNS records for domain verification.

{% hint style="info" %}
**DNS records**

You'll need access to the DNS record for every domain that you and your team use to login to Bird.

For example:

* If you login to Bird with an email address such as `user@mydomain.com` then you will need to edit the TXT record for `mydomain.com`.
* If you also have users login via <user@myotherdomain.com> then you will also need to edit the TXT record for myotherdomain.com.
  {% endhint %}

### Step one: Configure OpenID

When setting up an OpenID integration with your identity provider, start by creating the setup on the identity provider side.&#x20;

The main configuration item that will be needed is the redirect sign-in URL which is [`https://api.bird.com/auth/oidc/callback`](https://api.bird.com/auth/oidc/callback).&#x20;

{% hint style="warning" %}
Once the setup is complete, make sure to take a copy of the OpenID Client ID and Client Secret as these will be needed to complete the BirdCRM side of the setup.&#x20;
{% endhint %}

### Step two: Configure Bird CRM

1. Navigate to the [Settings](https://app.staging.bird.one/settings/security/access-settings) page by clicking on your current Workspace name in the bottom left, then  selecting **Access Management** under the **Organization** tab.

<p align="center"><img src="https://3861485111-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9kiDiTGVD8kkbnKKyEn%2Fuploads%2FVeH7thtbaxAjojpefW6D%2Fimage.png?alt=media&#x26;token=b924fc70-44c9-4fb1-931b-911359778891" alt=""></p>

<figure><img src="https://3861485111-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9kiDiTGVD8kkbnKKyEn%2Fuploads%2FXitXtZK9BSKJDvnwO4pC%2Fimage.png?alt=media&#x26;token=67c33a9d-3817-454b-9b37-4e40d827dc9c" alt=""><figcaption></figcaption></figure>

2. Click **Set Up SSO**, then select **OpenID**.<br>

   <figure><img src="https://3861485111-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9kiDiTGVD8kkbnKKyEn%2Fuploads%2F9HbGkIQA7mzwddVjPOsl%2Fimage.png?alt=media&#x26;token=f7a4a30e-9bbc-4444-b422-2c90df1e4b54" alt=""><figcaption></figcaption></figure>
3. Fill out a name for the SSO setup and fill out your identity provider URL as the Issue URL. This URL will depend on which identity provider you use. As an example, in Okta the format is normally `companyname.okta.com`.&#x20;
4. Fill out the Client ID and Client Secret that you generated and saved while setting up the integration in your identity provider.
5. In Other Scopes, fill out email and then select ‘New scope: email’ to add it, as shown in the screenshot below.

<figure><img src="https://3861485111-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9kiDiTGVD8kkbnKKyEn%2Fuploads%2FvuhX5sHAWwVfirs7qP1k%2Fimage.png?alt=media&#x26;token=b4aa3656-a650-412f-a30f-a1a56e9b384a" alt="" width="375"><figcaption></figcaption></figure>

6. The setup should look something like this:<br>

   <figure><img src="https://3861485111-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9kiDiTGVD8kkbnKKyEn%2Fuploads%2F1uOv5MZ1P4FV3BQ10BK4%2Fimage.png?alt=media&#x26;token=1883bbb6-1d7b-498b-ad8a-817a9b6c1f1e" alt="" width="375"><figcaption></figcaption></figure>
7. Click **Confirm** and your SSO configuration will be saved.
8. Now you need to set up the identity provider initiated login. From the Access Management page, click on the 3 dots menu on the right of the identity provider you have configured, then click **View**.<br>

   <figure><img src="https://3861485111-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9kiDiTGVD8kkbnKKyEn%2Fuploads%2FsQuJ3LweT5DQKLsWW6pS%2Fimage.png?alt=media&#x26;token=ddf70870-c2e7-447a-991d-a35e7c7767d2" alt=""><figcaption></figcaption></figure>
9. You can see the Initiate Login URL at the bottom. Copy and paste this into the appropriate field in your Identity Provider configuration.<br>

   <div align="center"><figure><img src="https://3861485111-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9kiDiTGVD8kkbnKKyEn%2Fuploads%2FrdXNwKdNkVQ9CmkOJAPw%2Fimage.png?alt=media&#x26;token=9c2ae81a-c6f1-480b-bf30-888528ac552a" alt="" width="375"><figcaption></figcaption></figure></div>

### Step three: Domain validation

In order to restrict logins to only domains that you control, each unique domain you and your users login from will need to be validated. This is done via adding a TXT DNS record to the domain(s).&#x20;

1. First click on the Domain Validation button available when viewing your SSO integration.

<figure><img src="https://3861485111-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9kiDiTGVD8kkbnKKyEn%2Fuploads%2FFC839mhm0KBaokHOkML1%2Fimage.png?alt=media&#x26;token=0555056a-e9ce-4f22-b9ce-38d2a3d4f337" alt="" width="375"><figcaption></figcaption></figure>

1. Enter your company domain name that you login with (e.g. companyname.com) and click Create.

<div align="center"><figure><img src="https://3861485111-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FU9kiDiTGVD8kkbnKKyEn%2Fuploads%2F8v5nvcQQ5BfOe0GmrOR6%2Fimage.png?alt=media&#x26;token=94f95140-8b11-4bce-8f07-b1531083fd37" alt="" width="375"><figcaption></figcaption></figure></div>

1. You will then be presented with a unique string under the Challenge column that needs to be placed as a TXT record in your domain. If you are unsure how to add a TXT record please consult with your DNS provider.
2. Once you have added the TXT record to verify your domain, you can select Verify
3. If the TXT record was added correctly it will then show the Status of Verified.&#x20;

{% hint style="success" %}
You can now sign in with SSO!
{% endhint %}

<table data-view="cards"><thead><tr><th></th><th data-hidden></th><th data-hidden></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Next: Enforce Single-Sign On (SSO) →</strong></td><td></td><td></td><td><a href="enforce-single-sign-on-sso">enforce-single-sign-on-sso</a></td></tr></tbody></table>