Set up sign-in with the company account (SSO)

With an identity provider, your staff sign in with the company account they already have (single sign-on). For this, actaPASS speaks OpenID Connect, which Microsoft Entra ID, Okta or Keycloak support, for example.

For administrators only

You need administrator rights for the company account or the tenant.

Where to find it

my.actapass.com → Company accounts → ⋮ → Tenants → ⋮ next to the tenant → Domains → ⋮ next to the domain → Identity providers

Tip

You need a verified domain and an app registered with your identity provider (client ID, often a client secret). Microsoft 365 and Google are easier to connect in actaSIGN: Connect Microsoft 365 or Google.

There is no picture for this page: no domain is verified on the test environment.

1. Click Add. At the top is the redirect URI that your identity provider must accept. Enter it there.
2. Enter a Name and optionally a Description.
3. OpenID Connect meta data document: the address that usually ends in /.well-known/openid-configuration. Click Verify: actaPASS fills in OAuth 2.0 authorization endpoint, OAuth 2.0 token endpoint and OAuth 2.0 user info endpoint itself.
4. Application (Client) ID and, if your provider requires it, Client Secret.
5. Scopes, e.g. openid profile email.
6. Use PKCE (Proof Key for Code Exchange): leave it on if your provider supports it. Registered as SPA (Single Page Application): switch it on if the app is registered as an SPA with your provider.
7. Click Save.

Good to know

• The Client Secret is needed for confidential clients (e.g. Entra ID platform “Web”). For public clients (platform “SPA”), leave it empty.
• actaPASS no longer shows a saved secret. Leaving the field empty keeps it; Remove secret deletes it when you save.
• Anyone who signs in through the identity provider automatically becomes a member of your tenant.

See also

• Verify your company domain
• Sign in