What this is for
Instead of a Kanishu password, your people sign in with your organisation's own account — and your identity provider's own security (its MFA, its leaver process) applies. Included with the Enterprise plan of a product (Business on Policy and Assurance).
Moving between your products (every plan)
At the top of the page, Switch moving between products on / off decides whether someone signed in to one of your Kanishu products can open another from the product menu without signing in again. It applies to all your products at once and is recorded in History.
Setting it up (organisation owner)
My products → Single sign-on → Set up:
- Give these to your identity provider — create a SAML application for Kanishu using the identifier, reply URL and metadata URL shown. Send the user's email address as the Name ID, signed with SHA-256.
- Your identity provider's details — paste its metadata XML (easiest), or the identifier, sign-in URL and signing certificate. During a certificate renewal, add the next certificate too.
- Who signs in this way — your email domains. Your own email's domain is accepted as it is; for any other domain, prove you own it by adding the DNS TXT record shown.
- Optionally require it, so those people can't use a password at all. An administrator can still use their password if the identity provider is down.
The page shows when the last sign-in happened, and the reason for the last refused one.
Signing in
On any sign-in page, choose Sign in with your company, enter your work email, and you're sent to your identity provider. Afterwards pick the product to open.
Users created automatically (SCIM)
Your identity provider can also create, update and switch off users in your Kanishu products (joiners, movers and leavers) through SCIM 2.0 — the address and token are on the same page.