Single sign-on

Admins set up single sign-on (SSO) in Admin → SSO. The page has three tabs: Provider, Provisioning and Mode.

Provider

Choose a preset — Microsoft Entra ID, Google or Okta — which use OpenID Connect (OIDC), or Other IdP (SAML 2.0) for any other identity provider.

1. Copy the redirect URL (OIDC) or the entity ID and ACS URL (SAML) shown on the page into your identity provider.
2. Paste the client ID and secret (OIDC) or the IdP metadata (SAML) into Tradecraft. Secrets are stored encrypted and only shown as Configured.
3. Select Save, then Test sign-in to try it without affecting anyone else. For a custom OIDC issuer, Check issuer verifies it first.

Mode

• Off — members sign in with a Tradecraft password and MFA.
• Optional — both SSO and passwords work.
• Required — members must use SSO.

You can restrict SSO to your allowed domains and turn on just-in-time provisioning to create members on their first SSO sign-in.

Break-glass access

Required can only be turned on once at least one admin has a Tradecraft password and authenticator set up, so you can still get in if your identity provider is down.