CLOR help

Single sign-on

Let people at your domain sign in through your identity provider. Roles and company access stay in CLOR.

Accounting → Settings → Single sign-on → Add a provider. Name the e-mail domains the provider owns; from then on the sign-in screen offers “Continue with …” for those addresses. Passwords keep working alongside; switch the provider off to fall back.

OpenID Connect (Google Workspace, Microsoft Entra, Okta, Keycloak)

1. At the provider, create a web application and register the redirect URI shown at the top of the Single sign-on page (https://api.clor.in/api/auth/sso/callback). Scopes: openid, email, profile.
2. In CLOR enter the discovery URL or issuer (Google: https://accounts.google.com; Entra: https://login.microsoftonline.com/<tenant>/v2.0; Okta: https://your-org.okta.com), the client ID and secret.
3. Switch it on.

SAML 2.0 (Entra enterprise app, Okta, ADFS, Google)

1. Add a SAML provider with the provider's sign-in URL, entity ID and signing certificate (PEM or base64). Save.
2. The row now shows CLOR's Reply URL / ACS (…/api/auth/sso/saml/<id>/acs) and Identifier / Audience (…/metadata, which is also CLOR's metadata to import). Enter those at the provider. NameID should be the e-mail address.
3. Switch it on.

Who gets in

The provider vouches for the e-mail; CLOR vouches for the person. A sign-in is accepted for an existing CLOR user at one of the named domains — or, with “add automatically” on, a new user is made on the spot as a member of your company with the chosen role. To add people before they sign in, use directory sync.