Documentation

Single sign-on

People sign in to ViewGC through your own identity provider, and join your workspace the first time they do. Any OpenID Connect provider works.

1. Create an application in your provider

A web application using the authorization code flow, scopes openid email profile, with this redirect URI:

https://api.viewgc.com/v1/auth/sso/callback

Okta

  1. Applications, Create App Integration: OIDC, Web Application.
  2. Sign-in redirect URI: https://api.viewgc.com/v1/auth/sso/callback. Grant type: Authorization Code.
  3. Assign the people or groups who should use ViewGC.
  4. Issuer: your Okta domain, for example https://acme.okta.com (or the issuer of a custom authorization server).

Microsoft Entra ID

  1. App registrations, New registration, Web platform.
  2. Redirect URI: https://api.viewgc.com/v1/auth/sso/callback.
  3. Certificates & secrets: create a client secret.
  4. Issuer: https://login.microsoftonline.com/<tenant id>/v2.0

Google Workspace

  1. Google Cloud console, APIs & Services, Credentials, Create OAuth client ID: Web application.
  2. Authorized redirect URI: https://api.viewgc.com/v1/auth/sso/callback.
  3. Set the consent screen to Internal so only your organisation can use it.
  4. Issuer: https://accounts.google.com

2. Connect it in ViewGC

A workspace owner opens Settings, Single sign-on, and enters the issuer URL, client ID and client secret. ViewGC reads the provider’s configuration to check it, and stores the secret encrypted; it is never shown again.

3. Prove your email domains

Add each domain your people sign in with, then publish the TXT record shown, named _viewgc-sso.yourdomain.com, and press Check now. Only addresses on a verified domain sign in through your provider. Public mail services such as gmail.com can never be claimed, and a domain belongs to one workspace.

4. Optionally, require it

Once a domain is verified you can turn on Require single sign-on: passwords are then refused for addresses on your domains, on the web and in the app. The workspace’s owners can still use their password, so a problem with your provider never locks you out.

What people see

  • On the sign-in page and in the app, typing an address on your domain offers Continue with SSO.
  • The first sign-in creates their ViewGC account and adds them to your workspace as a member; an existing ViewGC account with that address is linked.
  • Owners and admins change roles under Settings, Members. Removing someone there removes their access to the workspace; signing in through your provider again does not add them back. Invite them to return.

Setting this up for a team? Tell us and we will help.