Skip to main content

Single Sign-On (SSO)

Let your team sign in to Yuki with your company's identity provider instead of a password or an emailed code. Yuki supports SAML and OpenID Connect (OIDC), which is built on OAuth 2.0.

Identity providerSAMLOpenID Connect
Okta✓✓
JumpCloud✓✓
PingOne (PingID)✓✓
PingFederate✓✓
Google Workspace✓

SSO is available for both Snowflake and BigQuery, and applies to your whole company.

info

Only users with the Admin role can set up SSO. Users still need a Yuki account, so invite them first.

How It Works​

While SSO is turned on, everyone in your company must sign in with your identity provider. On the Yuki login page, users enter their email and click Sign in with your provider to continue.

Admins can still sign in with their password or an emailed code, so you can't lock yourself out if your identity provider has an issue.

Set Up SSO​

  1. In Yuki, go to Settings and open the Single Sign-On tab
  2. Choose your identity provider
  3. If your provider supports both, choose SAML or OpenID Connect
  4. Follow the steps for your provider below. Yuki shows the values you need to copy into your identity provider, each with a copy button:
    • SAML: Single sign-on URL (ACS URL) and Audience URI (SP Entity ID)
    • OpenID Connect: Sign-in redirect URI and Initiate login URI
  5. Enter the details from your identity provider:
    • SAML: the Metadata URL, or paste the metadata XML instead
    • OpenID Connect: the issuer (or domain), Client ID, and Client secret
  6. Turn on Require <provider> sign-in for my company and click Save

You can save the configuration with the switch off to finish setting it up later. Users keep signing in with their password or an emailed code until you turn it on.

Okta​

SAML​

  1. In Okta Admin, go to Applications → Applications → Create App Integration. Choose SAML 2.0 and name the app.
  2. Paste the Yuki Single sign-on URL and Audience URI. Set Name ID format to EmailAddress and Application username to Email, then finish.
  3. On the app's Assignments tab, assign the people who should use Yuki.
  4. On the app's Sign On tab, copy the Metadata URL and paste it into Yuki.

OpenID Connect​

  1. In Okta Admin, go to Applications → Applications → Create App Integration. Choose OIDC - OpenID Connect, then Web Application.
  2. In Sign-in redirect URIs, paste the Yuki Sign-in redirect URI, then save the app.
  3. On the app's Assignments tab, assign the people who should use Yuki.
  4. In Yuki, enter your Okta domain (for example your-company.okta.com, without -admin), plus the Client ID and Client secret from the app's General tab. If you use a custom authorization server, paste its full issuer URL instead.
  5. Optional, to sign in by clicking Yuki in Okta: edit the app's General Settings, set Login initiated by to Either Okta or App, tick Display application icon to users, and paste the Yuki Initiate login URI.

JumpCloud​

SAML​

  1. In the JumpCloud Admin Portal, go to Access → SSO Applications → Add New Application → Custom Application. Choose Manage Single Sign-On (SSO) and Configure SSO with SAML.
  2. Paste the Yuki Single sign-on URL into ACS URLs and the Audience URI into SP Entity ID. Enter any unique IdP Entity ID (for example yuki), set SAMLSubject NameID to email, and tick Declare Redirect Endpoint.
  3. On the app's User Groups tab, give access to the people who should use Yuki, then save.
  4. Open the app's SSO tab, click Copy Metadata URL, and paste it into Yuki.

OpenID Connect​

  1. In the JumpCloud Admin Portal, go to Access → SSO Applications → Add New Application → Custom Application. Choose Manage Single Sign-On (SSO) and Configure SSO with OIDC.
  2. Paste the Yuki Sign-in redirect URI into Redirect URIs, set the client authentication type to Client Secret Post, and turn on the Email and Profile scopes.
  3. On the app's User Groups tab, give access to the people who should use Yuki, then save. JumpCloud shows the Client ID and Client secret only once, so copy them.
  4. In Yuki, keep the issuer as is (https://oauth.id.jumpcloud.com) and enter the Client ID and Client secret.

PingOne (PingID)​

SAML​

  1. In the PingOne admin console, go to Applications → Applications, click +, choose SAML Application, then Manually Enter.
  2. Paste the Yuki Single sign-on URL into ACS URLs and the Audience URI into Entity ID, then save.
  3. On the app's Attributes tab, map saml_subject to Email Address. Then turn the app on with the switch next to its name - new apps start off.
  4. On the app's Configuration tab, copy the IDP Metadata URL and paste it into Yuki.

OpenID Connect​

  1. In the PingOne admin console, go to Applications → Applications, click +, and choose OIDC Web App.
  2. On the app's Configuration tab, paste the Yuki Sign-in redirect URI into Redirect URIs and set Token Endpoint Authentication Method to Client Secret Post.
  3. On the app's Resources tab, tick the email and profile scopes.
  4. Turn the app on with the switch next to its name - new apps start off. All users get access by default.
  5. In Yuki, enter the Issuer, Client ID, and Client Secret from the app's Overview tab. The issuer starts with auth.pingone.com (or .eu, .ca, or .asia, depending on your region).
  6. Optional, to sign in by clicking Yuki in PingOne: set the app's Initiate Login URI to the Yuki Initiate login URI.

PingFederate​

SAML​

  1. In PingFederate, go to Applications → SP Connections and create a connection with the Browser SSO profile and SAML 2.0.
  2. Use the Yuki Audience URI as the partner's Entity ID, and the Single sign-on URL as the Assertion Consumer Service URL with the POST binding.
  3. Send the user's email address as the SAML subject, with the email address NameID format.
  4. Export the connection's metadata and paste it into Yuki, or enter your PingFederate metadata URL.

OpenID Connect​

  1. In PingFederate, go to Applications → OAuth → Clients and add a client with the Authorization Code grant type and OpenID Connect enabled.
  2. Add the Yuki Sign-in redirect URI as a redirect URI, and use a client secret for client authentication.
  3. In Yuki, enter your PingFederate base URL as the Issuer, plus the Client ID and Client secret.

Google Workspace​

Google Workspace supports SAML only.

SAML​

  1. In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app. Name the app Yuki and continue.
  2. On the Google Identity Provider details step, click Download metadata and keep the file, then continue.
  3. Paste the Yuki Single sign-on URL into ACS URL and the Audience URI into Entity ID. Leave Signed response unchecked, set Name ID format to EMAIL and Name ID to Basic Information > Primary email, then finish.
  4. Open the app's User access and turn it on for everyone, or for the organizational units that should use Yuki. Google can take up to 24 hours to apply this.
  5. In Yuki, paste the contents of the downloaded metadata file into Metadata XML.

Users sign in from the Yuki login page. Clicking Yuki in the Google app launcher doesn't start a sign-in.

Manage SSO​

Once SSO is saved, the Single Sign-On tab shows its status - for example, Active: Okta with SAML is on for your company.

  • Turn SSO off: switch off Require <provider> sign-in for my company and click Save. The configuration stays saved, and users sign in with their password or an emailed code again.
  • Rotate the client secret (OIDC): paste the new secret into Client secret and click Save. Leave the field blank to keep the saved secret.
  • Switch provider or protocol: click Change provider, or choose the other protocol, then complete the setup and click Save. Saving replaces your current configuration.
  • Remove SSO: click Remove <provider> to delete the configuration.