➤ Product: OfficeRnD Flex

➤ Who: Admins

➤ Where: On the Admin Portal, under Settings > Authentication & SSO

➤ Availability: Single sign-on is included on the Scale plan and is a paid add-on on the Grow plan. The Essentials and Start plans don't include it.

A teammate who leaves your company keeps a working OfficeRnD Flex login until an admin manually deactivates that account. Single sign-on (SSO) moves that control to the identity provider your company already runs. Your identity provider approves each login to OfficeRnD Flex, under the password rules you set there. When you also turn off password login, removing someone from your identity provider revokes their access to your space.

OfficeRnD Flex has 2 separate SSO integrations, one for members and one for admins.

Before you start

Collect the following before you start. Each item blocks the setup if it is missing.

An identity provider that supports OpenID Connect (OIDC). OfficeRnD Flex does not support other authentication protocols, such as SAML.
Permission to create an application in that identity provider. You must copy 3 values from the application later.
Access to Settings on the Admin Portal.
An account in your identity provider that you can use for a test login. Test SSO before you enforce it, so a wrong setting doesn't lock anyone out.

How SSO works in OfficeRnD Flex

OfficeRnD Flex connects to your identity provider with OpenID Connect (OIDC). The connection carries no passwords into OfficeRnD Flex. Your identity provider confirms who the person is, and OfficeRnD Flex logs that person in.

Using SSO provides several benefits for organizations and users:

Reduces the number of passwords that users must remember.
Simplifies username and password management for admins.
Reduces security risks for organizations, members, partners, and vendors.
Speeds up the login process and improves onboarding for new applications.

The 2 available SSO integrations are Member SSO Authentication and Admin SSO Authentication:

Member SSO Authentication covers logins on the Member Portal and in the Members app.
Admin SSO Authentication covers logins on the Admin Portal.

Each integration has its own Return URL. A Return URL is the address your identity provider sends the person back to after it confirms the login. One application in your identity provider can serve both integrations, because most providers accept more than one redirect URI per application.

Decide how your members log in

The 2 integrations connect OfficeRnD Flex to your identity provider. Neither integration changes the login page your members use today. Two settings on Member SSO Authentication decide that, and you set both during setup.

Account Activation decides whether an existing member can log in without an invitation:

When Account Activation is turned on, a member who already exists in OfficeRnD Flex can log in to the Member Portal with SSO. That member receives no welcome email.
When Account Activation is turned off, an admin must invite each member first. Invite a member to the Member Portal and the Members app →

Turn Off Password Login decides whether the email and password login stays available to members. Turn it on when you want SSO to be the only way into the Member Portal. Your identity provider then holds the only credentials that work. An account you close in your identity provider can no longer reach your space.

Important: 'Turn Off Password Login' removes 4 things from your space: the standard email and password login, the public calendar page and the sign-up page, the password reset links, and the login token inside the welcome email. Members who cannot reach your identity provider have no other way in.

Connect SSO for the Member Portal

Your 2 settings decisions apply only after you connect Members SSO Authentication. The steps in this section describe how you can connect it.

Your identity provider has its own screens and its own field names. Use the guide for your provider alongside the steps in this section.

The steps below apply to every OIDC provider. Move between the 2 browser tabs as the steps direct you.

Log in to your identity provider.
Create a new application for OfficeRnD Flex. Select the OpenID Connect protocol and the web application type, because OfficeRnD Flex accepts no other protocol.
In OfficeRnD Flex, go to Settings > Authentication & SSO.
Click Activate next to Member SSO Authentication.
Click Configure. The Edit Authentication Integration dialog opens.
Copy the Base URL and the Return URL from the dialog.
In your identity provider, paste the Base URL into the base URL field of your application. Not every provider has this field. Go to the next step when your provider does not ask for a base URL.
In your identity provider, paste the Return URL into the redirect URI field of your application. Providers name that field differently. For example, Okta calls it Sign-in redirect URIs, and Google calls it Authorized redirect URIs.
In OfficeRnD Flex, enter the Client ID, the Client Secret, and the discovery URL in the matching fields.
In the Title field, enter the text for the SSO button on the login page. For example, enter Log in with Google so members recognize the provider.
Set Account Activation and Turn Off Password Login to the values you decided.
Click Update.

Open the Member Portal in a private browser window and log in with SSO. A test login confirms the configuration, while email and password login remains available as a fallback.

Connect SSO for the Admin Portal

Members can log in with SSO, and your admin teammates still use the OfficeRnD email and password. Admin SSO Authentication changes that. It has its own Return URL, which you add to the application you already created.

In OfficeRnD Flex, go to Settings > Authentication & SSO.
Click Activate next to Admin SSO Authentication.
Click Configure.
Copy the Return URL from the dialog.
In your identity provider, open the application you created for the Member Portal.
Add the copied Return URL as a second redirect URI. Keep the first redirect URI, because the Member Portal login stops working without it.
Save the application in your identity provider.
In OfficeRnD Flex, enter the Client ID, the Client Secret, and the discovery URL. These are the same 3 values you used for Members SSO Authentication.
Click Update.

Important: The Return URL of 'Admin SSO Authentication' differs from the Return URL of 'Member SSO Authentication'. An identity provider rejects any redirect URI it does not have on file, so admin login fails until you add the second Return URL.

Enforce SSO for your admin teammates

Both integrations now work, and each admin teammate can choose between SSO and the OfficeRnD email and password. Turning on Enforcing SSO would remove that choice.

Warning: After you turn on Enforcing SSO, no admin can use the OfficeRnD email and password login. If 'Admins SSO Authentication' points to the wrong application, every admin in the organization loses access to the Admin Portal.

Complete the following checks first. Each check protects against a lockout that you cannot undo from inside the Admin Portal.

Log in to the Admin Portal with SSO at least once, and confirm that the login succeeds.
Compare the Return URL in Admin SSO Authentication against the redirect URIs in your identity provider. The 2 values must match exactly.
Save the Base URL and both Return URLs somewhere outside OfficeRnD Flex. You need them to rebuild the application if your identity provider loses it.

After the 3 checks pass, turn on Enforcing SSO and click Update.

Best practices

If you plan to enforce SSO for admins, first log in with SSO in a second browser. Keep one session open in the original browser so you have a working way into the Admin Portal while you test.
If your members join your space through the sign-up page, keep Turn Off Password Login turned off. That setting removes the sign-up page, and new members lose the page they sign up on.

FAQ

Does OfficeRnD Flex support SAML?

OfficeRnD Flex does not support SAML. Both SSO integrations use OpenID Connect (OIDC), so your identity provider must offer an OIDC application type.

Do I need 2 applications in my identity provider?

You do not need 2 applications in your identity provider. One application serves both integrations, as long as you add the Return URL for Members SSO Authentication and the Return URL for Admins SSO Authentication as redirect URIs.

Can members still log in with an email and password after I turn on SSO?

Members can still log in with an email and password after you turn on SSO. The email and password login disappears only when you turn on Turn Off Password Login.

Why does OfficeRnD Flex show the message 'Failed to resolve discoveryUrl'?

OfficeRnD Flex shows the message 'Failed to resolve discoveryUrl' when it cannot read the OpenID configuration at the address you entered. Enter the address in the other format your identity provider supports. For example, the documented address for Okta is https://{your-okta-domain}/oauth2/default/.well-known/openid-configuration. When that address returns the message, use https://{your-okta-domain}/.well-known/openid-configuration instead.

What happens if I am an admin in 2 OfficeRnD organizations with different login methods?

You are logged out of the first organization each time you switch to the second one. One organization requires SSO and the other requires a password, and OfficeRnD Flex ends the session rather than carrying it across the 2 login methods.

Set up single sign-on (SSO)

In this article: