Documentation

Single sign-on

People sign in to ViewGC through your own identity provider, and join your workspace the first time they do. Any OpenID Connect provider works. Single sign-on comes with the Enterprise plan.

1. Create an application in your provider

A web application using the authorization code flow, scopes openid email profile, with this redirect URI:

https://api.viewgc.com/v1/auth/sso/callback

Okta

  1. Applications, Create App Integration: OIDC, Web Application.
  2. Sign-in redirect URI: https://api.viewgc.com/v1/auth/sso/callback. Grant type: Authorization Code.
  3. Assign the people or groups who should use ViewGC.
  4. Issuer: your Okta domain, for example https://acme.okta.com (or the issuer of a custom authorization server).

Microsoft Entra ID

  1. App registrations, New registration, Web platform.
  2. Redirect URI: https://api.viewgc.com/v1/auth/sso/callback.
  3. Certificates & secrets: create a client secret.
  4. Issuer: https://login.microsoftonline.com/<tenant id>/v2.0

Google Workspace

  1. Google Cloud console, APIs & Services, Credentials, Create OAuth client ID: Web application.
  2. Authorized redirect URI: https://api.viewgc.com/v1/auth/sso/callback.
  3. Set the consent screen to Internal so only your organisation can use it.
  4. Issuer: https://accounts.google.com

2. Connect it in ViewGC

A workspace owner opens Settings, Single sign-on, and enters the issuer URL, client ID and client secret. ViewGC reads the provider’s configuration to check it, and stores the secret encrypted; it is never shown again.

3. Prove your email domains

Add each domain your people sign in with, then publish the TXT record shown, named _viewgc-sso.yourdomain.com, and press Check now. Only addresses on a verified domain sign in through your provider. Public mail services such as gmail.com can never be claimed, and a domain belongs to one workspace.

4. Optionally, require it

Once a domain is verified you can turn on Require single sign-on: passwords are then refused for addresses on your domains, on the web and in the app. The workspace’s owners can still use their password, so a problem with your provider never locks you out.

What people see

  • On the sign-in page and in the app, typing an address on your domain offers Continue with SSO.
  • The first sign-in creates their ViewGC account and adds them to your workspace as a member; an existing ViewGC account with that address is linked.
  • Owners and admins change roles under Settings, Members. Removing someone there removes their access to the workspace; signing in through your provider again does not add them back. Invite them to return.

Setting this up for a team? Tell us and we will help.