Dropstone Support

Single sign-on (SSO)

Connect your organization's identity provider so members sign in to Dropstone with their work credentials. SAML 2.0 and OpenID Connect are supported, with just-in-time provisioning of new members.

With single sign-on, members of your organization sign in to Dropstone through your identity provider instead of with a separate Dropstone password. Access follows your directory: someone who can sign in to your company can sign in to Dropstone, and someone who cannot, cannot.

SSO is available on the Enterprise plan.

Supported protocols

  • SAML 2.0
  • OpenID Connect (OIDC)

Any identity provider that speaks either works, including Okta, Microsoft Entra ID, and Google Workspace.

Just-in-time provisioning

When SSO is connected, a member who signs in for the first time is added to the organization automatically. There is no invitation step. Their Dropstone account is created on first sign-in, with a private memory of their own from the start.

For control over who is in which team, and for removing people when they leave, pair SSO with SCIM provisioning.

Setting it up

An organization admin configures SSO from the organization settings in the dashboard.

  1. Choose SAML or OIDC.
  2. Copy the values Dropstone shows you (the service provider details for SAML, or the redirect URI for OIDC) into your identity provider, and create an application for Dropstone there.
  3. Copy the values your identity provider gives you back into Dropstone.
  4. Test with your own account before enforcing it.

Once enabled, members sign in at the usual place and choose Sign in with SSO, entering their work email. Dropstone routes them to your identity provider and back.

Enforcing SSO

An admin can require SSO for the organization, so members can no longer sign in with a Dropstone password or a personal Google or GitHub account. Enforce it only after you have confirmed SSO works, since it applies to admins too.

SSO and the CLI

The CLI signs in through the browser, so dropstone login works with SSO: it opens your identity provider, and the terminal picks up the session when sign-in completes. See Create an account and sign in.

Troubleshooting

"No organization found for this email." The email domain is not yet associated with your organization, or SSO is not configured. An admin can check the organization settings.

Sign-in loops back to the identity provider. Usually a mismatch between the URLs configured on each side. Re-check the values from step 2 and 3.

A member can sign in but is not in the right team. SSO handles sign-in; team membership is set in the dashboard or through SCIM.

For anything else, contact support with your organization name.

Ctrl+I