Skip to main content
Cantina supports enforcing single sign-on for all users in your email domain, with two supported providers: Google SSO and Okta (OIDC). Both are configured from Organization Settings → Single Sign-On.

​
Google SSO Enforcement

This section explains how to enforce Google OAuth/SSO authentication for users in the your-company.com email domain.

​
Create SSO Enforcement Rule

  1. Navigate to Organization Settings → Single Sign-On.
  2. Select Add SSO Enforcement Rule.
  3. In Email Domain, enter: your-company.com
  4. Create rule

​
Expected Behavior

Once enabled, all users with an email address ending in @your-company.com will be required to sign in using Google SSO. Users will no longer be able to authenticate with password-based login methods for this domain.

​
Okta Configuration

Cantina integrates directly with Okta for authentication. The setup process involves configuring an application in Okta’s admin console and then connecting it through Cantina’s SSO settings.

​
Okta Settings

  1. Navigate to the Okta Admin Console and select Applications.
  2. Click Create App Integration and select OIDC - OpenID Connect, then click Next.
  3. Select Web Application as the application type.
  4. Configure your application:
    • Name your application (e.g., “Cantina”)
    • Set the Sign-in redirect URI to: https://cantina-prod.us.auth0.com/login/callback

​
Cantina Settings

  1. Go to your organization’s SSO settings at https://cantina.xyz/organization/settings/sso
  2. Click Add SSO Connection
  3. Enter the following information from your Okta application:
All users with this email domain will be automatically redirected to Okta when they log in to Cantina.

​
Testing

After configuration, log out of Cantina and attempt to sign in using your email address. You should be automatically redirected to Okta’s authentication system.