Single sign-on

Single sign-on puts a team's vaults behind your identity provider, such as Microsoft Entra ID, Okta or Google. A device then opens the team's vaults only after its user has signed in there recently. It adds to the master password; it never replaces it.

On morphgate.com, single sign-on is part of the Business plan and the team trial. It supports OpenID Connect and SAML 2.0, one at a time per team.

How it works for members

  • Your vault keys still come from your master password. Single sign-on only decides whether the server hands your device the team's encrypted vaults.
  • Each device signs in on its own. The sign-in lasts as long as the team set (12 hours by default), then the device signs in again.
  • Your personal vault is never affected.
  • Someone your identity provider disables can't sign in again, so their access to the team's vaults ends when their current sign-in expires. Removing them from the team ends it at once.

Signing in from the app

When a team's vaults wait for single sign-on, the sidebar shows Sign in to and the team's name.

  1. Choose it. MorphGate explains that the team keeps its vaults behind single sign-on, and names the provider.
  2. Choose Sign in. Your browser opens at your identity provider. If it didn't open, choose Open it.
  3. Sign in there. The browser says you're signed in to the team and can return to MorphGate.
  4. Back in MorphGate, the team's vaults sync. The dialog updates by itself.

The address you sign in with at the provider must be the same as your MorphGate account's address. The team's page in the app shows the provider and until when this device is signed in.

Vaults already on your device stay there while they wait, unsynced edits included.

Set it up (owners and admins)

Single sign-on is set up on the team page at morphgate.com, under Single sign-on. Pick the Protocol.

OpenID Connect

  1. At your identity provider, register an application with the redirect URI shown on the team page: https://morphgate.com/sso/callback.
  2. On the team page, enter the Issuer (for example https://login.microsoftonline.com/<tenant>/v2.0 or https://acme.okta.com), the Client ID and the Client secret.
  3. Set Sign in again after (hours), from 1 to 720.
  4. Tick Require single sign-on for the team's vaults when you're ready, and choose Save single sign-on.

MorphGate checks the issuer's discovery document before it saves, so a wrong issuer is refused. It asks the provider for openid email profile, and the token's email must match the member's MorphGate address and not be marked unverified. The client secret is stored encrypted; leave the field empty later to keep it.

SAML 2.0

  1. At your identity provider, create a SAML application with the entity ID (audience) and ACS (reply) URL shown on the team page, or give it the metadata at that entity ID. They have the form https://morphgate.com/sso/saml/<team id>/metadata and https://morphgate.com/sso/saml/<team id>/acs.
  2. Send the email address as the NameID or as an email attribute. Sign the response or the assertion. Don't encrypt the assertion.
  3. On the team page, enter the Provider metadata URL, which fills in the rest, or enter the Provider entity ID (issuer), the Provider sign-in URL (HTTP-Redirect) and the Provider signing certificate yourself. Paste several certificates to cover a rollover.
  4. Set Sign in again after (hours), tick Require single sign-on for the team's vaults, and choose Save single sign-on.

MorphGate rejects unsigned responses, SHA-1 signatures, responses it didn't ask for, and responses meant for another team. It reads the email from the email or mail attribute, the standard email claim URIs, or a NameID that is an email address.

Requiring it

Setting up a provider alone doesn't lock anything. Members can already sign in with it, but the vaults only wait for it once Require single sign-on for the team's vaults is on. Requiring it without a provider has no effect.

Removing it

Remove single sign-on deletes the provider and every device's sign-in, and turns the requirement off. Setting up, removing and members signing in all appear in the activity log.

If the team leaves Business

The provider stays, and stays required if it was. Admins can remove it but can't change it until the team is on Business again.

Self-hosting

The reference server supports OpenID Connect single sign-on, set up from its command line. SAML is only on morphgate.com. See Run your own sync server.