Introduction
This article addresses common questions about Single Sign-On (SSO) for enterprise users, covering both general SSO concepts and specific details about integrating SSO with Runway.
For a detailed walkthrough to set up SSO, please see the Configuring Enterprise SSO guide.
General SSO FAQs
What is OIDC-based SSO?
OIDC-based SSO (OpenID Connect-based Single Sign-On) is an authentication protocol that enables your organization's members to access multiple applications using one set of credentials.
When users log into Runway, they're redirected to your organization's login system. After successful authentication, they're redirected back to Runway with a secure code that automatically logs them in or registers them using their verified email address.
What is the SSO domain?
SSO ties all of the users from a specific domain to the users of the owner of that domain. The portion of your organization's email format after the @ typically defines your domain.
How do I know if my organization's IDP (Identity Provider) supports OIDC?
A majority of the common IDP providers do, including: Okta, Ping Identity, Google, Auth0, and Azure AD/Entra.
If unsure, your organization's identity or security team should know.
Runway-integrated SSO FAQs
Which members have permissions to configure SSO?
Admins or billing admins of the workspace can configure SSO.
Do people need a Runway account before they can sign in with SSO?
No. The first time someone on your SSO domain signs in with SSO, Runway creates an account for them using their verified email address (sometimes called just-in-time or JIT provisioning).
Joining your Enterprise workspace works one of two ways. By default, a workspace admin invites them and they accept the invite by signing in with SSO. With automatic workspace enrollment turned on, anyone on your verified domain who signs in with SSO is added to the workspace with no invite. You can request automatic enrollment when you verify your domain during setup, or by contacting support if your configuration is already live.
Removing people is still manual. SSO doesn't sync removals from your identity provider, so a workspace admin removes them from the workspace.
Does one SSO configuration cover every workspace in my organization?
No. SSO is configured per workspace and tied to that workspace's registered domains, so a policy on one workspace doesn't carry over to the others. To enforce the same policy on another workspace, select it from your Organization space, select + New SSO config, open the Duplicate settings tab and choose the workspace to copy from. See Copying SSO from a Workspace.
Organization admins can also set a default SSO configuration under Org settings › SSO so every new workspace inherits it. This applies to new workspaces only.
Team members on your domain must use SSO on every workspace that has the policy, and can still sign in with username and password on workspaces that don't.
What happens to existing accounts when we turn on SSO?
Existing accounts stay as they are. SSO matches people to their account by verified email address, so they keep their account, workspace access, projects and assets. The only change is how they sign in: once SSO is enforced for your domain, they use the Use Single Sign-On (SSO) option instead of a password. Anyone already signed in stays signed in until they sign out.
New SSO policies start as optional so your team can test before Runway enforces SSO across your domain (see Testing the SSO Configuration). Once enforced, people with email addresses outside your domain can still sign in with username and password, and accounts on your domain that aren't yet in your Enterprise workspace join the same way new accounts do.
Can multiple domains be added for a single workspace?
Yes, you can have multiple IDPs or configurations for different domains, but they cannot be for the same email domain.
I have already previously set up my SSO config with Runway, but now I need to add a new domain.
Please reach out to support with the additional domain(s) needed.
Can Enterprise workspace members change their email?
No, the option to change the email address is disabled on accounts associated with an Enterprise workspace.
Can external domains, like gmail.com, be supported for SSO?
Unfortunately, no. This is a limitation of SSO. Your organization must control the domain name that you are setting up SSO for. Users who are not on that domain can still be added to the workspace using the existing non-SSO tools but will not log in with SSO.
Does Runway Enterprise SSO support SAML (Security Assertion Markup Language)?
At this time, no. We do not support SAML.
Does Runway Enterprise SSO support SCIM (System for Cross-domain Identity Management)?
At this time, no. We do not support SCIM.