Single sign-on

Pick your identity provider

Farside speaks standard SAML 2.0 and OpenID Connect, so most providers can connect. We have step by step guides for two of them.

• OktaA SAML app integration, with an OpenID Connect alternative.
• Microsoft Entra IDAn enterprise application, with an app registration alternative.

At a glance

Use these when you are comparing providers or checking what Farside supports.

Values Farside gives you

When you add a provider, Farside generates a provider ID and shows the values below with a copy button next to each. Use the ones Farside displays. The placeholders here stand in for your own provider ID.

Name ID and attributes

Farside accepts a persistent or email address Name ID. Transient Name IDs are rejected, since they change on every sign-in and Farside could not tell who came back.

Send the user's email address as an attribute named email. It is required. First name, last name, display name and groups are optional. If your provider uses different attribute names, edit the attribute mapping on the provider in Farside.

OpenID Connect details

• Scopes requested: openid, email and profile.
• Farside refuses sign-in when the provider says email_verified is false.
• Client secret authentication (basic or post) is detected automatically from the discovery document.
• ID tokens must be signed with an RS, PS or ES algorithm.

Test, then activate

Editing the trust settings of an active provider (certificates, issuer, client ID or secret, endpoints) takes it offline until you test it again. Plan those changes for a quiet hour, or set up a second provider as a draft, test it, and switch over.

1. Back in Farside, choose Test connection. Farside sends you through your identity provider and checks the response.
2. Fix anything the test reports, then run it again. The test has to pass after every configuration change before Activate is allowed.
3. Choose Activate. Only one provider can be active in a workspace at a time. To switch providers, disable the live one first, then activate the new one.

How people sign in

On the Farside login page, people choose Sign in with SSO and enter the workspace ID. Farside sends them to your identity provider and brings them back signed in.

Once your workspace has verified its email domain, people can enter their work email address instead of the workspace ID. Until then, the workspace ID is the way in, so share it with your team.

Accounts, linking and new users

Someone who already has a Farside account is asked for their Farside password the first time they sign in with SSO, plus their authenticator code if they have one set up. That happens once, and it links the two. Farside never links an account on a matching email address alone.

New accounts are created on first sign-in only for email addresses on a domain your workspace has verified. They get the provider's default role, either Member or Admin, which you choose when you set it up.

Someone you invited from outside a verified domain accepts the emailed invitation first, then signs in with SSO.

MFA and offboarding

If your identity provider enforces multi-factor authentication, turn on the Your IdP enforces MFA toggle. Farside then skips its own authenticator prompt, but only for people who belong to no other Farside workspace. Anyone who also belongs to another workspace still gets the prompt, because that workspace has not agreed to your provider's policy.

Disabling a provider signs out every session that was started through it. Once people have signed in through a provider it stays as a disabled record, and only an unused provider can be deleted. If you use SCIM provisioning, anyone it has deprovisioned is refused at SSO sign-in as well.

Farside warns in the SSO panel when your provider's signing certificate expires within 30 days. To renew, re-import the metadata. The import URL is remembered, so it is one click. If the metadata lists both the current and the new certificate, sign-in stays on. If it only has the new one, Farside turns single sign-on off until you run a passing test and activate it again.

Troubleshooting

Next: automate provisioning

Single sign-on controls who can get in. SCIM controls who exists. Set up both and people lose access to Farside when they leave your directory.

• SCIM provisioning overviewHow users and groups are provisioned and deprovisioned.