Help CentreYour SSO connection stops working when its client secret expires, and nobody in your organisation can sign in with SSO. Replace the secret before it is due.
Who Can Do This
Anyone with permission to manage SSO. The Owner role has it by default.
When Your Secret Is Due
Your secret is due on the expiry date you entered for it. If you did not enter one, it is due 90 days after it was last changed.
The Single sign-on page shows the due date. Add your secret's expiry date from your identity provider so the due date matches it.
Reminders
Everyone with permission to manage SSO is emailed 30, 7 and 1 day before the secret is due, and on the day. If it becomes overdue, they are emailed once a week until it is replaced.
Replacing the Client Secret
Replace the secret with no downtime:
- Create a new secret in your identity provider. Keep the old one for now.
- In Settings → Single sign-on, paste the new secret, add its expiry date, and save.
- Check that signing in works, then delete the old secret in your identity provider.
Saving the same secret again does not change the due date.
Changing Other Details
You can also change the Issuer URL, Client ID and Email claim. Changing the issuer URL needs a new client secret as well.
Changes to the issuer URL, client ID or client secret are checked with your identity provider before they are saved. Changes to the email claim are not, so test signing in after changing it. To change your email domains or turn SSO sign-in on or off, contact Veridox support.
Important: If you choose a custom email claim, use a field only your IT admin can change. If users can edit it, they could sign in as each other.
Related
- Setting Up SSO