Single sign-on

Sign in with your identity provider

Single sign-on (SSO) lets the people in your organization sign in to Modudraft with the account they already use at work, so you manage access in one place. You set it up on the organization page, in the Single sign-on section. It takes three steps: verify your email domain, connect your identity provider, and run a test sign-in.

Step by step Set up single sign-on

What it is

Modudraft supports the two common protocols. Pick the one your identity provider offers; each organization has one connection.

  • SAML 2.0 is the older, widely supported standard. Your provider gives you a metadata URL (or a metadata XML file) that describes it, and you give your provider three values from Modudraft.
  • OpenID Connect (OIDC) is the newer standard built on OAuth 2.0. You give your provider one redirect URL, and your provider gives you an issuer URL, a client ID and a client secret.

Both work the same for the person signing in: they enter their work email, go to your provider, and come back signed in.

Availability

Single sign-on is part of the Enterprise plan. If the plan ends, SSO sign-in stops working and Require SSO pauses, so people can sign in the usual way again. Your configuration is kept, and it works again when the plan returns.

1. Verify a domain

Modudraft decides who signs in through your provider by the domain of their email address, so first prove that you own the domain.

  1. In the Domains card, enter the domain (for example acme.com) and press Add domain.
  2. Modudraft shows a TXT record name and a TXT record value. The name is the domain itself. The value looks like modudraft-verification= followed by a long token.
  3. Add that TXT record in the DNS settings for the domain, at your DNS host.
  4. Press Check now. DNS changes can take a few minutes to appear, so try again if it is not found yet.
  • Public email domains such as gmail.com cannot be claimed.
  • A domain can be verified by one organization at a time.
  • Keep the TXT record in place. Modudraft looks it up again every day. If it is missing for 7 days, the domain becomes unverified, and the owner and admins are told by email. Put the record back and check again to verify it.
  • People on a newly verified domain are covered by Require SSO right away.

2. Connect your provider

In the Connection card, choose SAML or OpenID Connect. Modudraft shows the values your provider needs once you save the connection.

SAML

  • In Modudraft, enter either a Metadata URL from your provider or paste the Metadata XML.
  • In your provider, enter the ACS URL (the address that receives the sign-in response) and the Entity ID (also called the audience). Modudraft also shows an SP Metadata URL, which some providers can read instead of the two values.
  • Send the user's email address in the response. The email is how Modudraft matches the person.
  • Modudraft does not support providers that require signed sign-in requests.
  • When the provider's signing certificate is about to expire (within 30 days), Modudraft emails the owner and admins. Save the new metadata to replace it.

OpenID Connect

  • In your provider, enter the redirect URL that Modudraft shows, which is the address your provider sends people back to after sign-in.
  • In Modudraft, enter the Issuer URL, the Client ID and the Client secret.
  • If you change the issuer or the client ID later, you must enter the client secret again. Otherwise leave the secret blank to keep the current one.
  • Modudraft stores the client secret encrypted with the server's auth secret. If that auth secret is rotated, the stored client secret can no longer be read, and an admin must enter the client secret again. The settings page asks for it.

Metadata and issuer URLs must use HTTPS on the standard port. Other addresses are refused.

The guides below use the menu names from 2026. Names may differ slightly in your provider's console.

Okta

For SAML:

  1. In the Okta Admin Console, go to Applications and choose Create App Integration.
  2. Select SAML 2.0 and give the app a name such as Modudraft.
  3. Paste the Modudraft ACS URL into Single sign-on URL, and the Entity ID into Audience URI (SP Entity ID).
  4. Set Name ID format to EmailAddress and Application username to Email.
  5. Finish, then assign the people or groups who should use Modudraft on the Assignments tab.
  6. On the Sign On tab, copy the Metadata URL and paste it into Modudraft.

For OIDC, create an app integration with OIDC and Web Application, paste the Modudraft redirect URL into Sign-in redirect URIs, then copy the Client ID, Client secret and your Okta domain (the issuer) into Modudraft.

Microsoft Entra ID

For SAML:

  1. In the Entra admin center, go to Enterprise applications and choose New application, then Create your own application. Choose the option to integrate any other application not in the gallery.
  2. Open Single sign-on and choose SAML.
  3. In Basic SAML Configuration, paste the Modudraft Entity ID into Identifier (Entity ID) and the ACS URL into Reply URL (Assertion Consumer Service URL).
  4. Check that the email claim (user.mail) is sent, and that the people who should use Modudraft are assigned under Users and groups.
  5. Copy the App Federation Metadata Url from the SAML certificates section and paste it into Modudraft.

For OIDC, register an app under App registrations with a Web redirect URI set to the Modudraft redirect URL. Create a client secret under Certificates and secrets. Use the Application (client) ID as the Client ID, and the issuer https://login.microsoftonline.com/<tenant-id>/v2.0.

Google Workspace

For SAML:

  1. In the Google Admin console, go to Apps, then Web and mobile apps, and choose Add app, then Add custom SAML app.
  2. Name the app. On the next screen, download the IDP metadata file and paste its contents into Modudraft as Metadata XML.
  3. On the Service provider details screen, paste the Modudraft ACS URL and Entity ID. Set Name ID format to EMAIL and Name ID to Basic Information > Primary email.
  4. Finish, then open the app's User access and turn it ON for the right organizational units or groups.

For OIDC, use a Google Cloud OAuth client of type Web application, with the Modudraft redirect URL as an authorized redirect URI, and the issuer https://accounts.google.com.

Other providers

Any provider that speaks SAML 2.0 or OpenID Connect should work.

  1. Create a new SAML or OIDC application in your provider.
  2. For SAML, enter the Modudraft ACS URL and Entity ID, and make the user's email address the Name ID or an email attribute. For OIDC, enter the Modudraft redirect URL.
  3. Assign the people who should have access.
  4. Copy the provider's metadata URL or XML (SAML), or the issuer URL, client ID and client secret (OIDC), into Modudraft, and press Save connection.

3. Test

After saving, press Test connection. It needs a verified domain. Modudraft starts a sign-in at your provider, and the page shows the date of the last successful test. If it did not work, the Recent errors card lists what went wrong in the last 90 days. A successful test is required before you can turn on Require SSO.

Require SSO

Without Require SSO, SSO is one more way to sign in. With it, people on your verified domains can sign in only through your identity provider. Before you turn it on, the page lists what is missing: a connection, a verified domain and a successful test.

  • Who it covers: everyone whose email is on a verified domain, except the organization owner. Their other sign-in methods keep working, so the owner can always get in and fix a broken connection. Each owner sign-in without SSO is recorded, and the admins are emailed.
  • People who type their email on the sign-in page see This email signs in with single sign-on. with Continue with SSO and Use another sign-in method. The second option is the owner's recovery path.
  • Members who use an email outside your verified domains are not covered. The page lists them under Not covered by SSO.
  • Before you turn it on, Modudraft shows who will be affected. Signing in without SSO then stops for them.
  • API keys and the MCP are not affected. Remove people in Modudraft to revoke their keys.
  • To change the identity provider, switch off Require SSO first. Saving a connection with a different provider is refused while it is on.
  • It pauses by itself, and the page says why, when the plan is no longer Enterprise, the connection is deleted, or the organization has no verified domain left.

Joining with SSO

The Auto-join new people setting decides what happens when someone on a verified domain signs in through SSO and is not yet a member. It is on by default.

  • On: they join automatically, with the role you pick under Role for people who join with SSO (Member, or Admin if you are the owner).
  • Off: SSO sign-in is invite-only. Only people with a pending invitation can join.
  • People who already have a Modudraft account are asked once whether to join the organization, with a Join prompt, instead of being added without asking.
  • A member who was removed from the organization needs a fresh invite to join again, even when auto-join is on.
  • While Require SSO is on, people who already have an account on a verified domain can still sign in with SSO, even when they cannot join (auto-join is off, or they were removed). They sign in without joining the organization.
  • If the organization has no free seats, the person cannot join until a seat is free.

Troubleshooting

These are the messages people and admins see, and what they mean.

  • sso_required: Your organization requires single sign-on. Enter your work email and choose Continue with SSO.
  • sso_ask_admin: Ask your admin for an invite. Auto-join is off for this organization.
  • sso_domain_not_verified: Your email domain is not verified for this organization. An admin needs to verify it, or check its TXT record.
  • sso_removed_member: You were removed from this organization. Ask your admin for a new invite.
  • sso_seat_limit: This organization has no free seats. Ask your admin.
  • sso_unavailable: Single sign-on is not available for this organization. It is part of the Enterprise plan.
  • sso_owner: The organization's owner signs in their usual way, not with single sign-on.
  • sso_link_confirm: This email already has a Modudraft account. Sign in your usual way, then choose Sign in with SSO to link it.
  • client_secret_required: Enter the client secret again. It is required when the issuer or client ID changes.
  • sso_required_on: Switch off Require SSO before changing the identity provider.
  • unsafe_url: That URL cannot be used. Use a public https address on the standard port.
  • invalid_metadata: The SAML metadata could not be read. Check that it is the metadata from your identity provider.
  • domain_taken: Another organization has already verified this domain.
  • public_domain: Public email domains such as gmail.com cannot be claimed.
  • dns_unavailable: The DNS lookup is unavailable right now. Try again shortly.

For anything else, the Recent errors card on the organization page lists failed sign-ins and tests. Questions? Write to [email protected].