AI CodeOps

Single sign-on (SSO)

Single sign-on lets people use one identity provider login for many apps, over SAML 2.0 or OpenID Connect. How it works and how to set it up for AI CodeOps.

Single sign-on (SSO) lets people sign in to many applications with one account held by their organisation's identity provider (IdP), such as Okta, Microsoft Entra ID or Google Workspace. The application trusts the IdP's statement about who the person is instead of keeping its own password.

What it is

Two protocols carry most SSO for business software:

  • SAML 2.0, an OASIS standard. The IdP sends the application (the service provider) a signed XML assertion naming the user. The application checks the signature against the IdP's certificate.
  • OpenID Connect (OIDC), an identity layer on top of OAuth 2.0. The IdP issues a signed ID token after a browser redirect.

Sign-in can start at the application (SP-initiated) or at the IdP's dashboard (IdP-initiated). SP-initiated flows let the application check that a response answers a request it actually made.

Why it matters

With SSO, joining and leaving are handled in one place: disable someone in the IdP and their access to every connected app goes with it. Your password policy and multi-factor rules apply everywhere. For security reviews, it's often a requirement before a tool can hold source code.

In AI CodeOps

SSO is part of the Enterprise plan and belongs to the organization, not a single workspace. The setup, under Configure → Settings → Single sign-on:

  1. Verify your domain. Add the TXT record shown, then choose Check now:

``text Name: _codeopsstudio-verify.example.com Value: <the token on screen> ``

  1. Create a connection. Pick SAML 2.0 (IdP Entity ID, IdP SSO URL, IdP Certificate in PEM) or OpenID Connect (Issuer URL, Client ID, Client Secret), a verified domain and a Default Role: Member, Developer or Viewer.
  2. Configure your IdP with the values on the connection card:

``text SAML Metadata URL /sso/saml/<connection-id>/metadata (also the SP entity ID) SAML ACS URL /sso/saml/<connection-id>/acs (HTTP-POST) OIDC Redirect URI /sso/oidc/<connection-id>/callback ``

  1. Activate it and share https://console.aicodeops.dev/sso/login?domain=example.com.

For SAML, send the email as the NameID or an email attribute. AI CodeOps checks the signature, the audience, the expiry and that the response answers a sign-in it started. For OIDC it requests openid email profile and uses PKCE. The OIDC client secret is encrypted at rest.

The first SSO sign-in creates the account and adds the person to your organization. Choose Set this workspace as SSO default to place new people straight into a workspace with the connection's default role; you can change it later through role-based access control. A session started through your SSO reaches only your organization's workspaces and the person's own personal workspace.

Only an owner can create, edit and activate a connection. Changes are recorded as sso.connection.* and sso.domain.* events against the organization.

Frequently asked questions

Which AI CodeOps plan includes SSO?

Enterprise. SSO and domain verification are part of the Enterprise plan.

Does AI CodeOps support IdP-initiated SAML sign-in?

No. Sign-in must start at AI CodeOps, through the sign-in link. A tile on your identity provider's dashboard won't work.

Can people still sign in with a password once SSO is on?

Yes. SSO adds a way to sign in; it doesn't turn off password or social sign-in for your domain.