# Sign-in and directory

Connect your identity provider for single sign-on and manage how people join.

**Sign-in and directory** connects withHuman to your organization's identity provider. Single sign-on lets people use their work identity. Verified domains control sign-in for company email addresses, and directory sync keeps members and teams up to date. Sign-in and directory is part of the hosted edition: the open edition signs everyone in with email and password.

```mermaid
flowchart TD
  Provider["Your identity provider"]
  Provider --> SSO["Single sign-on"]
  Provider --> Directory["Directory sync"]
  Domain["Verified company domain"] -->|"Routes sign-in"| SSO
  SSO -->|"Confirms who is signing in"| Access["Access to withHuman"]
  Domain -->|"Optional automatic admission"| Members["Members"]
  Directory -->|"Keeps people and groups current"| Members
  Members --> Access
```

## Single sign-on

**Single sign-on**, or **SSO**, lets members sign in through an identity provider such as Okta, Microsoft Entra ID or Google. withHuman supports SAML and OpenID Connect (OIDC), the connection types your provider uses to confirm someone's identity.

Once an SSO connection is active, members must use it to enter the organization. A withHuman password no longer opens that organization.

SSO does not admit everyone at the provider. People still need an existing membership, an invitation, directory provisioning or enabled [automatic admission](/docs/web-app/verified-domains#automatic-admission).

![Sign-in and directory settings showing separate Single sign-on, Verified domains and Directory sync sections before setup](/images/docs/sign-in-and-directory/settings-light.png)

SSO, domain verification and directory sync are configured separately.

## Connection setup

A **Setup link** opens guided configuration for your provider. It can be shared with the identity administrator, who can complete setup without a withHuman account. Treat it as a private administration link and use it before the displayed expiry.

The connection status shows whether setup is complete, along with the provider, protocol and issuer when connected. **Check again** refreshes that status. Creating a new setup link for an existing connection lets the administrator replace it.

Before connecting, make sure the people who need access, including organization owners, can sign in through the provider. Keep their work email addresses consistent with their withHuman accounts.

## Domains and membership

[Verified domains](/docs/web-app/verified-domains) prove that your organization controls a company email domain. With SSO connected, people using that domain are directed to your provider. You can optionally admit new members when they first sign in.

[Directory sync](/docs/web-app/directory-sync) manages people and groups from your directory, including suspensions and departures. Use it when membership should follow the directory automatically.

## Access and availability

Viewing connection settings and changing them require separate permissions. An administrator who manages connections can create setup links and manage domain claims.

**Connector not enabled** means SSO and directory services are unavailable on this deployment. Ask the deployment administrator to enable them. **Could not reach the connector** means withHuman could not check connection status; try **Check again** and contact the administrator if it continues.

Connection and membership changes are recorded in [Audit log](/docs/web-app/audit-log).