Single Sign-On (SSO)

Single Sign-On (SSO) allows your team members to authenticate with Stallion using your organization's existing identity provider. This provides a seamless and secure login experience while giving administrators centralized control over access.

Benefits of SSO

• Centralized Access Control - Manage user access through your existing identity provider
• Enhanced Security - Leverage your organization's authentication policies, MFA, and session management
• Simplified Onboarding - New team members can access Stallion immediately using their existing credentials
• Audit & Compliance - Track authentication events through your identity provider's logging

Supported Protocols

Stallion currently supports authentication via OpenID Connect (OIDC), an industry-standard protocol built on top of OAuth 2.0. OIDC provides secure, token-based authentication with support for modern security features.

Supported Identity Providers

Stallion supports SSO integration with the following identity providers:

How It Works

1. Admin configures SSO - An organization admin sets up the connection between Stallion and your identity provider
2. User initiates login - Team members click "Sign in with SSO" on the Stallion login page
3. Redirect to IdP - Users are redirected to your identity provider's login page
4. Authentication - Users authenticate using their existing credentials (including MFA if configured)
5. Token exchange - Upon successful authentication, Stallion receives an ID token containing user information
6. Session created - Stallion creates a session and grants access based on the user's organization membership

SSO Admins

Once SSO is enforced, everyone in your organization signs in through your identity provider. SSO admins are the exception: when they enter their email, they can choose password or SSO. This ensures you can still get in if SSO is misconfigured or your identity provider is unavailable.

You can designate additional SSO admins, or hand the role over entirely, from Organization → Members. This means the person who sets up SSO does not have to be the one who holds password access afterwards — a common requirement when IT configures SSO but a security team owns the fallback account.

Passkeys

SSO admins sign in with a password plus a one-time code sent to their email. A passkey is also required by default, exactly as it is for every other Stallion account.

An SSO admin can turn on Allow SSO admins to sign in without a passkey under Organization → Members, and then waive the passkey requirement for individual SSO admins. The waiver only applies while all of the following hold, so turning the org-wide setting off restores the passkey requirement immediately:

• the account is an SSO admin,
• the organization has the setting enabled, and
• that specific admin has had the requirement waived.

Getting Started

To configure SSO for your organization, select your identity provider from the list below:

• Okta OIDC - Configure SSO with Okta
• Microsoft Entra ID OIDC - Configure SSO with Azure AD / Microsoft Entra ID
• Keycloak OIDC - Configure SSO with Keycloak
• Google OIDC - Configure SSO with Google Workspace
• General OIDC - Configure SSO with any OIDC-compliant provider

Requirements

Before setting up SSO, ensure you have:

• A Stallion account (SSO is free on all plans)
• Admin access to your organization in Stallion Console
• Admin access to your identity provider
• The ability to create OIDC applications in your identity provider