Skip to main content
Your SSO connection stops working when its client secret expires, and nobody in your organisation can sign in with SSO. Replace the secret before it is due. You manage the connection in the Veridox dashboard under Settings → Single sign-on. It is not available via the API.

​
Permission

Requires organisation_sso:write, which the Owner role holds by default.

​
When Your Secret Is Due

Your secret is due on the expiry date you entered for it. If you did not enter one, it is due 90 days after it was last changed. The Single sign-on page shows the due date. Add your secret’s expiry date from your identity provider so the due date matches it.

​
Reminders

Everyone with organisation_sso:write is emailed 30, 7 and 1 day before the secret is due, and on the day. If it becomes overdue, they are emailed once a week until it is replaced.

​
Replacing the Client Secret

Replace the secret with no downtime:
  1. Create a new secret in your identity provider. Keep the old one for now.
  2. In Settings → Single sign-on, paste the new secret, add its expiry date, and save.
  3. Check that signing in works, then delete the old secret in your identity provider.
Saving the same secret again does not change the due date.

​
Changing Other Details

You can also change the Issuer URL, Client ID and Email claim. Changing the issuer URL needs a new client secret as well. Changes to the issuer URL, client ID or client secret are checked with your identity provider before they are saved. Changes to the email claim are not, so test signing in after changing it. To change your email domains or turn SSO sign-in on or off, contact Veridox support.
If you choose a custom email claim, use a field only your IT admin can change. If users can edit it, they could sign in as each other.

​
Related