> ## Documentation Index
> Fetch the complete documentation index at: https://docs.k16solutions.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on overview

> Plan and manage SAML or OIDC identity providers for your K16 workspace.

Open **Settings** > **Single sign-on** to view identity providers. A role with view permission can inspect providers. A role with SSO management permission can create, edit, enable, disable, and delete them.

## Choose a protocol

| Protocol | Use it when                                                        | K16 configuration                                                                        |
| -------- | ------------------------------------------------------------------ | ---------------------------------------------------------------------------------------- |
| SAML     | Your identity provider exchanges SAML 2.0 metadata and assertions. | Metadata XML or HTTPS metadata URL, email attribute mapping, and optional single logout. |
| OIDC     | Your identity provider supports OAuth 2.0 and OpenID Connect.      | Issuer, client registration, claim mapping, and discovered or manual endpoints.          |

<CardGroup cols={2}>
  <Card title="Configure SAML" icon="certificate" href="/administration/sso/saml">
    Exchange service-provider values and SAML metadata.
  </Card>

  <Card title="Configure OIDC" icon="key" href="/administration/sso/oidc">
    Register a callback and configure issuer discovery.
  </Card>
</CardGroup>

## Configuration flow

<Steps>
  <Step title="Start in K16">
    Select **New identity provider** and choose **SAML** or **OIDC**.
  </Step>

  <Step title="Copy service-provider values">
    Use the values shown in **Service provider values** to configure the application in your
    identity provider.
  </Step>

  <Step title="Enter identity-provider values">
    Return to K16 and complete the protocol-specific fields.
  </Step>

  <Step title="Create the provider">
    Keep **Enabled for sign-in** on only when you are ready to test, then select **Create**.
  </Step>

  <Step title="Test with a pilot user">
    Assign a test user in the identity provider and use the normal K16 sign-in flow. Keep the
    current administrator session open until the test succeeds.
  </Step>
</Steps>

Provider names must be at least three characters and cannot contain spaces or underscores. The protocol and provider name cannot be changed after creation. Create a replacement provider when either must change.

<Warning>
  Do not delete a working provider until its replacement has passed sign-in and sign-out testing.
  Provider changes can take several minutes to appear.
</Warning>

See [Troubleshoot SSO](/administration/sso/troubleshoot) when sign-in fails.