Single sign-on (SSO)
Single sign-on lets people sign in to many apps with the one login their company already runs, instead of a separate password for each app.
Also called: SSO, company login, SAML, OpenID Connect, SCIM
With single sign-on, an app hands the sign-in to the company’s identity system, the one that already holds everyone’s account and checks their password and second step. The identity system tells the app who signed in, and the app lets them in. Two standards do most of this work: OpenID Connect and SAML 2.0.
Sign-in is only half of it. SCIM is a separate standard that lets the identity system create, update and turn off people in the app automatically, so a person who leaves the company loses access without anyone remembering to remove them app by app.
Two things are worth checking before you rely on it: that the company’s email domain is proved to the app, so nobody else can sign people in for it, and that there is a safety net, such as an owner who can still sign in the usual way if the identity system is down.
Example
An auto group has 40 people across six shops, each with a company login.
The owner connects the company login and proves the company’s domain once.
A new hire types a work email, signs in at the company, and lands in NextUp. When they leave, turning them off at the company ends their access if user sync is on; without it, the owner removes them from the team.
How NextUp Walk-in handles it
On the Pro plan and up, turned on for a business on request, the owner connects the company’s own login over OpenID Connect or SAML 2.0, proves the email domain with a DNS record, and tests it before turning it on. SCIM 2.0 user sync covers people and the groups the company’s system pushes; the owner can list which of the company’s groups mean manager, staff or a custom role (a named set of manager permissions), and a person’s role follows them when they sign in or when the groups change. A company sign-in counts as the second step, and by default NextUp relies on the company’s own multi-factor policy without checking it.
Questions
What is the difference between SAML and OpenID Connect?
Both let an identity system tell an app who signed in. SAML is the older standard, built on signed XML. OpenID Connect is newer, built on signed tokens. Most identity systems offer at least one of them.
What is SCIM?
SCIM is a standard for syncing people from an identity system into an app: creating them, updating them and turning them off. It is separate from signing in.