> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO Configuration

> Learn how to configure SSO enforcement for your Cantina organization

Cantina supports enforcing single sign-on for all users in your email domain, with two supported providers: Google SSO and Okta (OIDC). Both are configured from **Organization Settings → Single Sign-On**.

## Google SSO Enforcement

This section explains how to enforce Google OAuth/SSO authentication for users in the `your-company.com` email domain.

### Create SSO Enforcement Rule

1. Navigate to **Organization Settings → Single Sign-On**.
2. Select **Add SSO Enforcement Rule**.
3. In **Email Domain**, enter: `your-company.com`
4. Create rule

### Expected Behavior

Once enabled, all users with an email address ending in `@your-company.com` will be required to sign in using Google SSO.

Users will no longer be able to authenticate with password-based login methods for this domain.

***

## Okta Configuration

Cantina integrates directly with Okta for authentication. The setup process involves configuring an application in Okta's admin console and then connecting it through Cantina's SSO settings.

### Okta Settings

1. Navigate to the Okta Admin Console and select Applications.
2. Click Create App Integration and select OIDC - OpenID Connect, then click Next.
3. Select Web Application as the application type.
4. Configure your application:
   * Name your application (e.g., "Cantina")
   * Set the Sign-in redirect URI to: `https://cantina-prod.us.auth0.com/login/callback`

### Cantina Settings

1. Go to your organization's SSO settings at [https://cantina.xyz/organization/settings/sso](https://cantina.xyz/organization/settings/sso)
2. Click Add SSO Connection
3. Enter the following information from your Okta application:

| Field           | Description                                                                                 |
| --------------- | ------------------------------------------------------------------------------------------- |
| Okta Tenant URL | Your Okta domain URL. Remove "-admin" from your admin panel URL if present.                 |
| Client ID       | Found in your Okta application settings (see below).                                        |
| Client Secret   | Found in your Okta application settings (see below).                                        |
| Email Domain    | The email domain for your organization. Contact Cantina support if you need to modify this. |

All users with this email domain will be automatically redirected to Okta when they log in to Cantina.

### Testing

After configuration, log out of Cantina and attempt to sign in using your email address. You should be automatically redirected to Okta's authentication system.