Enable SSO
Single sign-on (SSO) lets your team sign in to Texture through your organization's identity provider (IdP). With Enforce SSO on, they must use the IdP. With it off, a Texture password still works.
Texture supports two ways to connect your IdP:
- Okta, using OpenID Connect (OIDC)
- Generic SAML, for any IdP that supports SAML
Before you begin#
You need:
- The Admin role in your Texture organization
- Admin access to your IdP, so you can create an app for Texture
Step 1: Open SSO settings#
In the Texture dashboard, go to Settings → SSO, then choose your Identity provider: Okta or Generic SAML.
Step 2: Connect your identity provider#
Your IdP app must send the person's email and mark it verified. Texture rejects a first-time sign-in without a verified email.
Texture matches an email domain on the part after @ exactly. acme.com does not include mail.acme.com. A domain can belong to only one Texture organization.
Okta#
- Copy the Sign-in redirect URI that Texture shows.
- In Okta, create an OIDC web application and paste the URI into its Sign-in redirect URIs field. See Okta's guide to creating an OIDC app.
- Back in Texture, fill in these fields:
| Field | What to enter |
|---|---|
| Okta domain | Your Okta domain, without https:// (for example, acme.okta.com) |
| Client ID | The Client ID from your Okta app |
| Client secret | The Client secret from your Okta app. Texture doesn't store it. |
| Email domains | The email domains to send to your IdP at sign-in (for example, acme.com) |
- Click Save SSO configuration.
Generic SAML#
Texture shows the ACS URL and Entity ID only after you save.
- In your IdP, start a SAML app for Texture. You will add the ACS URL and Entity ID after you save in Texture.
- In Texture, fill in these fields:
| Field | What to enter |
|---|---|
| SAML sign-in URL | Your IdP's SAML sign-in URL |
| SAML sign-out URL (optional) | Your IdP's SAML sign-out URL |
| SAML signing certificate (PEM) | Paste your IdP's signing certificate, or click Choose file… to upload a .pem, .crt, .cer, or .txt file |
| Email domains | The email domains to send to your IdP at sign-in (for example, acme.com) |
- Click Save SSO configuration.
- Copy the ACS URL and Entity ID that Texture shows, and add them to your SAML app.
Saved settings can't be edited. To change a field, delete the configuration and create it again. If Enforce SSO is on, turn it off first.
Step 3: Validate the connection#
After saving, click Validate now. Texture checks that the connection is in place and that your email domains are listed. For Okta, it also checks that Texture can reach your Okta domain. It does not complete a sign-in.
Then confirm the redirect URI, or the ACS URL and Entity ID, in your IdP. Sign in with your own work email before you turn on Enforce SSO.
Step 4: Set your SSO policy#
Once SSO is set up, choose how your team signs in under SSO Policy:
| Setting | What it does | When to turn it on |
|---|---|---|
| Enforce SSO | Members must sign in through your IdP. | After you have signed in with your own work email. Admins aren't exempt, so make sure you can sign in through your IdP, or add yourself as an SSO exemption, before you turn this on. Leave it off during rollout so a password still works. |
| Auto-create users on first sign-in (JIT) | Creates a Texture account on first SSO sign-in with the User role, unless the person was invited with a different role. When it's off, only people who already have a Texture account can sign in through SSO, and only if auto-link is on. | If you want your IdP to control who has access. |
| Auto-link existing users by verified email | Links a first-time SSO sign-in to an existing member of this organization, or to someone with a pending invitation, when the email matches. | Before rollout, if your team already has Texture accounts. |
Let specific people sign in with a password#
When Enforce SSO is on, add SSO exemptions for people who can't be in your IdP, such as external collaborators. Enter the email and an optional reason. That address has to be a verified email on their Texture account.
How sign-in works#
People enter their email address on the Texture sign-in page and click Continue. If the domain after @ is listed in your SSO configuration, Texture sends them to your IdP. Otherwise, they sign in with their Texture password.
Login with password instead is always on that page. It uses the Texture password when Enforce SSO is off. When Enforce SSO is on, only an SSO exemption can use it.
If multi-factor authentication is on for the organization, Texture emails a six-digit code after the IdP sign-in. See Multi-factor authentication.
Troubleshooting#
People can't sign in after you set up SSO
- Okta: check that the Sign-in redirect URI from Texture is in your Okta app's Sign-in redirect URIs.
- SAML: check that the ACS URL and Entity ID from Texture are in your IdP's SAML app.
- Check that your IdP sends the person's email and marks it verified. Texture rejects a first-time sign-in if it doesn't.
Then click Validate now in Settings → SSO to see which of its checks fail.
Existing members aren't linked to their IdP accounts
Turn on Auto-link existing users by verified email. The person must already be a member of this organization, or have a pending invitation. Your IdP must mark the email verified. If an existing member's Texture email isn't verified yet, Texture sends a verification email and finishes the link after they click it.
You want to allow password sign-in again
Turn off Enforce SSO. The configuration stays in place.
You need to change or remove SSO
Turn off Enforce SSO first. Otherwise, members who aren't exempt can't sign in with a password after you delete the configuration.
Then in Settings → SSO, under Need to make changes?, click Delete SSO configuration, then confirm. Members fall back to password sign-in until you save a new configuration.