> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tightknit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on (SSO)

> Single Sign-On for your Tightknit community site

export const PlanAvailability = ({feature = 'This feature', plan = 'enterprise', addon = false, plural = false, support = false, growth, momentum, enterprise, children}) => {
  const rank = {
    growth: 0,
    momentum: 1,
    enterprise: 2
  };
  const normalize = value => {
    if (value === true || value === 'included' || value === 'yes') {
      return 'included';
    }
    if (value === 'addon') {
      return 'addon';
    }
    return 'none';
  };
  const defaultStatus = p => {
    if (rank[p] < rank[plan]) {
      return 'none';
    }
    return addon ? 'addon' : 'included';
  };
  const overrides = {
    growth,
    momentum,
    enterprise
  };
  const status = p => overrides[p] === undefined ? defaultStatus(p) : normalize(overrides[p]);
  const plans = [{
    key: 'growth',
    label: 'Growth'
  }, {
    key: 'momentum',
    label: 'Momentum'
  }, {
    key: 'enterprise',
    label: 'Enterprise'
  }];
  const included = plans.filter(p => status(p.key) === 'included');
  const asAddon = plans.filter(p => status(p.key) === 'addon');
  const verb = plural ? 'are' : 'is';
  const srSentence = [feature, verb, 'available on:', included.map(p => `${p.label} plan`).join(', ') || 'no plans', asAddon.length > 0 ? `; as an add-on: ${asAddon.map(p => `${p.label} plan`).join(', ')}` : ''].join(' ');
  const statusCell = s => {
    if (s === 'included') {
      return <svg className="plan-availability-check" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="3" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
          <path d="M20 6 9 17l-5-5" />
        </svg>;
    }
    if (s === 'addon') {
      return <span className="plan-availability-addon">Add-on</span>;
    }
    return <span className="plan-availability-none">—</span>;
  };
  return <div className="plan-availability">
      <span className="plan-availability-sr">{srSentence}</span>
      <div className="plan-availability-content" aria-hidden="true">
        <div className="plan-availability-feature">{feature}</div>
        {(support || children) && <div className="plan-availability-body">
            {support && <>
                Contact <a href="mailto:support@tightknit.ai">Support</a> if you
                don't see this option or want to enable it for your community.
              </>}
            {children && <> {children}</>}
          </div>}
      </div>
      <div className="plan-availability-matrix" aria-hidden="true">
        {plans.map(p => <div className="plan-availability-plan" key={p.key}>
            <span className="plan-availability-plan-name">{p.label}</span>
            {statusCell(status(p.key))}
          </div>)}
      </div>
    </div>;
};

<PlanAvailability feature="SSO functionality" />

Tightknit supports enterprise Single Sign-On (SSO) to integrate with your organization's identity provider, enabling seamless and secure authentication for your community members.

## Supported Protocols

Tightknit supports the following industry-standard SSO protocols:

* **OIDC (OpenID Connect)** - Modern authentication protocol built on OAuth 2.0
* **SAML 2.0** - Enterprise-grade XML-based authentication standard
* **Token-based JWT** - Custom integrations for IdP-initiated flows

## Supported Authentication Flows

### SP-Initiated Flow

Users start at your Tightknit community and are redirected to your identity provider to authenticate. After successful authentication, they are returned to Tightknit and logged in automatically.

```mermaid theme={null}
sequenceDiagram
    autonumber
    actor Member
    participant Site as Tightknit community site
    participant IdP as Your identity provider

    Member->>Site: Visit site and choose SSO login
    Site->>IdP: Redirect with authentication request<br/>(OIDC or SAML)
    IdP->>Member: Prompt to authenticate<br/>(or reuse an existing session)
    Member->>IdP: Authenticate
    IdP->>Site: Redirect back with signed assertion
    Site->>Member: Session created, member is signed in
```

### IdP-Initiated Flow

Users start at your identity provider portal and can access your Tightknit community directly from there. They land on Tightknit already authenticated without needing to sign in again.

```mermaid theme={null}
sequenceDiagram
    autonumber
    actor Member
    participant IdP as Your identity provider portal
    participant Site as Tightknit community site

    Member->>IdP: Sign in to the IdP portal
    Member->>IdP: Open the Tightknit tile
    IdP->>Site: Redirect with signed JWT
    Site->>Site: Validate token and match the member
    Site->>Member: Session created, member is signed in
```

<Info>
  IdP-initiated SSO requires Token-based JWT configuration. Please contact
  support to enable this feature.
</Info>

## Supported Identity Providers

Tightknit works with major enterprise identity providers, including:

* Google Workspace
* Microsoft Azure AD / Entra ID
* Okta
* Auth0
* OneLogin
* And other OIDC/SAML-compliant providers

## Getting Started

To set up SSO for your organization, contact [support@tightknit.ai](mailto:support@tightknit.ai) with:

* Your company name
* Your email domain
* Your identity provider

Our team will guide you through the configuration process and provide the necessary technical details for your IT team to complete the integration.

## Troubleshooting

If you encounter issues with SSO authentication, please contact [support@tightknit.ai](mailto:support@tightknit.ai) with:

* A description of the issue
* Any error messages you see
* Screenshots if available

Our support team will help resolve any configuration issues.


## Related topics

- [Authentication](/community-site/authentication.md)
- [Slack SSO with Auth0](/guides/slack-sso-external-idp.md)
- [Single & Multi-Channel Guests](/slack/guests.md)
- [Security at Tightknit](/security/overview.md)
- [Members](/studio/members.md)