Sign in to Turtini with your own identity provider (SAML or OIDC)

Your people can sign in to Turtini with the identity provider you already run -- Okta, Entra ID, Ping, JumpCloud, or any SAML 2.0 / OIDC provider.

**Before you start: prove the domain**

Single sign-on binds to a domain, and Turtini will only bind a domain you have proven you control. Open **Settings -> Organizations -> Verified domains**, add your domain, publish the DNS TXT record it gives you, and press Verify. Until that says Verified, the domain does not appear in the single sign-on picker at all.

This is not paperwork. It is what stops anyone else from claiming to be the place your people sign in.

**Set up the connection**

1. In **Settings -> Organizations -> Single sign-on**, press **Set up single sign-on**.
2. Pick the verified domain and whether your provider speaks **SAML 2.0** or **OIDC**.
3. Give the connection a name your people will recognize. It is the label on the button they press, so "Acme Okta" beats "SAML1".
4. Fill in what your provider gave you:
- SAML: the IdP entity ID (issuer), the sign-on URL, and the x509 signing certificate as PEM text including its BEGIN and END lines.
- OIDC: the issuer URL, client ID, and client secret. The secret goes to the identity configuration, never into a Turtini database record.
5. Save. Turtini shows you the two values to paste back into your provider: the **Reply / ACS URL** and the **Audience / Entity ID**.
6. Set the connection to **Active** when your provider is configured.

**Reading the status honestly**

A connection shows one of:

- **Active** -- live; your people can use it now.
- **Saved, not live** -- the configuration is stored and correct, but the underlying Google Cloud project has not been upgraded to Identity Platform yet, so no sign-in can complete through it. Turtini says this rather than showing a button that would fail. Ask your Turtini administrator to finish the upgrade, then press **Retry provisioning**.
- **Draft** / **Disabled** -- saved but deliberately not offered at sign-in.

**What your people see**

They type their work email at the normal sign-in box. When the address belongs to a connected domain, a **Continue with <your connection name>** button appears. Nothing about their existing account changes; they are the same person with the same history.