# Single sign-on URL: /security/sso Connect Foxborne to your identity provider over SAML 2.0, so people sign in with the account they already have and acknowledge the system use notice first. Only the break-glass account signs in locally. Single sign-on puts every sign-in behind your identity provider, so the accounts and controls you already run decide who reaches the evidence. Foxborne supports single sign-on over SAML 2.0 or OIDC. The **Sign-in** tab under **Access** configures SAML 2.0, and this page covers it. Single sign-on is required for everyone except the break-glass account, which exists for the day the identity provider is down. ## Before you start [#before-you-start] * You need the **Admin** role. Only admins hold **Manage hosting, keys and access**. * You can create a SAML 2.0 application in your identity provider and assign people to it. * You have picked a quiet moment. Changing the identity provider signs everyone out. * The break-glass account and its hardware security key are at hand, in case sign-in fails. ## Connect your identity provider [#connect-your-identity-provider] In the console, go to **Access** and open the **Sign-in** tab. The **Single sign-on** panel shows the connection Foxborne uses today. SAML 2.0 Okta `https://foxborne.hfr.internal/saml/metadata` `https://foxborne.hfr.internal/saml/acs` Expires 14 Mar 2028 Yes, for everyone except the break-glass account These values come from the example dataset. On your deployment, **Entity ID** and **Reply URL** start with its own host name. Create a SAML 2.0 application for Foxborne. Enter the **Entity ID** as the service provider's entity ID, which some providers call the audience. Enter the **Reply URL** as the assertion consumer service URL. Assign the application to the people who use Foxborne. With SCIM on, assign the five Foxborne groups instead, as [SCIM provisioning](/security/scim) describes. If your deployment enforces export control, add an attribute named `usPerson` to the assertion. Evidence marked EXPT opens only for users whose identity provider asserts US person status. [Export-controlled evidence](/security/export-control) covers the attribute. Select **Edit** on the **Single sign-on** panel. The **Single sign-on** dialog opens with the warning **Changing the identity provider signs everyone out.** Enter the address of your provider's SAML metadata in **Metadata URL**. The **Signing certificate** field is read-only. Select **Save**. The console confirms **Metadata refreshed. Nothing else changed.** The audit log records **Changed SSO settings** on **Access**, with the detail **Metadata refreshed**. Open the console in a private browser window. Read the system use notice, tick **I understand and consent**, then select **Continue with** and your provider's name, such as **Continue with Okta**. Your provider signs you in and returns you to **Incidents**. The console confirms **Signed in as** and your name. ## The sign-in screen [#the-sign-in-screen] The sign-in screen has no sidebar, top bar or status bar. Its card holds, from top to bottom: 1. The Foxborne logo, **Sign in** and a line naming your organization and its identity provider. 2. A tile with your organization's initials, its name and the deployment's host name. 3. The **System use notice**, with the checkbox **I understand and consent**. 4. **Continue with** and your provider's name, disabled until the checkbox is ticked. 5. The **Break-glass access** divider, an **Email** field and **Use a hardware security key**. Under the card, a line names the version and where it runs, such as **Foxborne 1.4.2, self-hosted in AWS GovCloud (US-West).** The notice is acknowledged before every session. Each acknowledgment writes **Acknowledged notice** on **Sign-in** to the audit log, with the detail **System use notice**. Admins write the notice in **Settings**, as [CUI marking](/security/cui-marking#set-the-system-use-notice) describes. ## Break-glass access [#break-glass-access] The break-glass account is a local account for when the identity provider is down. It requires a hardware security key, and passwords alone are refused. The **Break-glass access** panel on the **Sign-in** tab names the account and states both rules: * **Every break-glass sign-in is audited and raises an alert in your SIEM.** * **Requires a hardware security key. Passwords alone are refused.** To use it, enter the account's email under **Break-glass access** on the sign-in screen and select **Use a hardware security key**. When the console shows **Touch your security key to continue**, touch the key. The audit log records the sign-in, such as **Signed in** on **Local account** with the detail **Break-glass admin with hardware key**. On **Members**, the break-glass account shows **Local, hardware key** under **Sign-in** and carries a **Break-glass** chip. ## Sessions [#sessions] Once someone is signed in, the session policy decides how long they stay signed in. The **Sessions** panel on the same tab shows the **Idle timeout**, the **Longest session**, **Two-factor** and the allowed **Networks**. [Set the session policy](/security/manage-access#set-the-session-policy) walks through each option. ## Check the result [#check-the-result] * The **Single sign-on** panel names your provider under **Identity provider** and shows an expiry date under **Signing certificate**. * On **Members**, people who signed in through your provider show **Single sign-on** under **Sign-in**. * The audit log holds a **Changed SSO settings** entry, then an **Acknowledged notice** entry for each sign-in. ## Troubleshoot [#troubleshoot] **Continue with your provider stays disabled.** The consent box is not ticked. Tick **I understand and consent**: the notice is acknowledged before every session. **Everyone was signed out.** Changing the identity provider signs everyone out, as the dialog warns. People sign in again through the new provider. **The identity provider is down.** Sign in with the break-glass account and its hardware security key. Every use is audited and alerts your security team. **The Email field turns red on the break-glass path.** The field is empty. Enter the break-glass account's email, then select **Use a hardware security key** again. **A signed-in person cannot open export-controlled evidence.** Their **US person** column on **Members** reads **Not asserted**. See [Export-controlled evidence](/security/export-control). ## Next [#next] * [SCIM provisioning](/security/scim) keeps the member list in step with your identity provider's groups. * [Roles and permissions](/security/roles) lists what each of the five roles may do. * [Invite, change and remove access](/security/manage-access) covers members, roles and the session policy.