Appearance
Single Sign-On (SSO)
Mailisk uses OpenID Connect (OIDC) for SSO and supports SCIM provisioning for centrally managing organisation users and roles. OIDC and SCIM are configured separately: OIDC authenticates users, while SCIM manages their access.
What is SSO?
Single Sign-On (SSO) allows organizations to centrally manage how their teams authenticate and access services such as the Mailisk Dashboard.
Mailisk supports authentication via email, GitHub, and Enterprise SSO using OpenID Connect (OIDC). Users can sign in using identity providers such as Okta, Azure AD, and others. On a first SSO sign-in, Mailisk may email a short verification code before creating or linking the account. No account or login session is created until that code is accepted.
Requirements
To configure SSO you will need:
- An identity provider that supports OpenID Connect (OIDC)
- Administrator access to your identity provider
- A Mailisk account with permission to configure SSO
To provision users before they sign in, configure SCIM provisioning after completing the SSO setup.
Integration Information
If you want to require users from your organization to authenticate through SSO, you can request domain enforcement. Once enabled, users with that email domain will only be able to sign in via SSO.
For example, users with @myorg.com will not be able to create an account or sign in using other methods. They must authenticate through the SSO login page.
Sign-in Redirect URI
https://api.mailisk.com/auth/openid/callbackRoot API URL
https://api.mailisk.comLinking existing users
If a user created a Mailisk account using another authentication method before SSO was enabled, Mailisk does not link it based only on the email asserted by the identity provider. The user must prove control of the account email with the verification code before the OIDC identity is linked.
An existing account whose email has not yet been verified is never promoted or linked by the SSO flow. Finish that account's normal email verification (or recover the account) first, then restart SSO. This prevents credentials created before mailbox ownership was proven from inheriting SCIM access.
When SCIM provisions the same account email, Mailisk can adopt an existing non-owner account for organisation access management. See Existing Mailisk users. SCIM adoption does not itself link the account to an OIDC identity.
Support can pre-approve an identity link when mailbox verification is not practical.
Other providers
Use the redirect URI and API URL above with the provider's web application settings.