Connect your organization’s sign-in
Let colleagues sign in to your Undertitle workspace with their existing work account. An administrator configures and enables the connection in the workspace UI. Testing sign-in is optional and remains available before or after enabling SSO. No configuration files or deployment changes are needed.
Before you start
You need an Undertitle workspace administrator account and permission to register an application in your identity provider. You can work with your IT administrator to complete the provider steps.
Open your own workspace. In Tenant management → Single sign-on, choose Add connection. Copy the Sign-in redirect URI shown there. Use that exact URL in your identity provider, including its hostname and /sso/callback path.
The guides and screenshots use example names and identifiers. Replace them with your own values. Undertitle screenshots show an isolated demonstration workspace. Provider screenshots come from the linked official documentation and can show older menu labels.
What happens when someone signs in
A successful first SSO login creates a workspace user. Your identity provider controls who can access the Undertitle application. Restrict that access to the people who should join your workspace. Every workspace user can manage the workspace.
An existing workspace user or a central super admin can also create an account. Public self-registration is unavailable.
If an account already exists with that email, Undertitle does not link it automatically. The person signs in with their existing password, opens Settings → Profile, and chooses Connect, followed by the connection name, under Single sign-on. They then authenticate with the identity provider. If they have no password, they can use Forgot password? when the account has an accessible email address.
Email verification and acceptance of the workspace’s legal documents can still be required after sign-in. SSO does not grant access to central super-admin management.
Scope and access
- One SSO connection can be active per workspace. Enabling another replaces the active connection.
- A configured connection keeps its provider type. To switch between Okta and Microsoft Entra ID, create a new connection, test it, and enable it. Existing users must explicitly link their accounts to the new connection.
- Password sign-in remains available. This version does not enforce SSO-only access.
- Groups, roles and permissions are not synchronized. Manage Undertitle roles inside the workspace.
- Start sign-in on your Undertitle workspace’s login page. The guides use the authorization-code flow, not unsolicited identity-provider callbacks.
- Signing out of Undertitle ends the Undertitle session. It does not sign you out of Microsoft or Okta.
- Removing someone’s provider assignment prevents a new provider sign-in. It does not immediately revoke an existing Undertitle session or their password access. Follow your workspace’s user-removal process as well.
API reference
SSO is for people signing in through the browser. API integrations use API keys. Open API documentation in your workspace, or visit /api/v1/docs on that workspace’s hostname for the existing API reference.