Solel//dev docs

Single sign-on

With , your people sign in to the apps they use at work with the Solel account they already have. You choose which teams may use each app, and turning someone's account off stops them signing in to all of them.

Which kind of app

  • Sign-in apps are for apps that support OpenID Connect, as many wikis and photo and media apps do.
  • SAML apps are for apps that only speak SAML 2.0, such as Slack, GitHub, Figma and Cloudflare.
  • Provisioning makes and turns off people's accounts in apps that take SCIM, so nobody does it by hand.

Each app you add shows in Work apps for the people allowed to use it. Your server needs its address first; see Network and domains.

Add a sign-in app

  1. Open Settings › Sign-in apps and choose Add an app.
  2. Give it a Name, and paste its Return addresses from the app's settings, one per line.
  3. Add a Start address if you'd like Work apps to open it somewhere particular, such as its sign-in page.
  4. If the app runs only in the browser, turn on It runs in the browser, with no server of its own. It gets no secret, and must use PKCE.
  5. Under Who can sign in, choose Certain teams, Certain people or Everyone in the organisation.
  6. Choose Add app, then copy the Client ID, and the Client secret if it has one, into the app. The secret is shown only once.

Most apps then need just the discovery address shown under Setting up an app, with the scopes openid profile email groups. If a secret is lost, choose Make a new secret…. The old one stops working straight away.

Add a SAML app

  1. Open Settings › SAML apps and choose Add an app.
  2. Give it a Name, and paste its Entity ID and ACS URL from the app's settings.
  3. Choose how the app knows people: By email address, which most apps want, or By their Solel ID. By email, only people whose email an admin has set in Directory can sign in.
  4. Choose who can sign in, then choose Add app.

In the app, give it the Metadata address, or paste the Sign-in address (SSO URL), the Issuer (entity ID) and the Signing certificate, all shown on the page.

SAML sign-in happens at 's own address, org. in front of your server's. If it doesn't have one yet, the page says so.

Send people to an app

  1. Add the app under Sign-in apps or SAML apps first.
  2. Open Settings › Provisioning and choose Add an app.
  3. Pick the app, then paste its SCIM address and SCIM token.
  4. Choose how to Name accounts by: Email address or Solel ID.
  5. Turn on Send teams too to send teams as groups, then choose Add app.

Everyone who may sign in to the app gets an account there. Anyone who leaves, or loses access, has theirs turned off, never deleted. People are sent every 30 minutes, straight after you save, and when you choose Send now.

If provisioning isn't part of your licence, the page says Not on your plan.