Skip to content
Authentication/
Single sign-on
/
/
Enforce SSO on tenant acc...
Last updated

Enforce SSO on tenant access

Without enforcement, a user who belongs to a tenant with SSO can still reach that tenant with another login method, such as a password. When you turn on Enforce SSO on tenant access, users must sign in through the tenant's SSO connection to access it. This applies at login, when switching tenants, and when refreshing a session.

Prerequisites

If you use embedded login, your app must use one of these Frontegg SDK versions or later, so users are redirected to SSO when required:

  • @frontegg/js 7.131.0
  • @frontegg/react 7.19.0
  • @frontegg/angular 7.24.0
  • @frontegg/vue 4.17.0

Enforcement applies to a tenant only when all of the following are true:

  • The tenant has an enabled SSO connection (SAML or OIDC). See Single sign-on overview.
  • The connection's SSO standard is turned on in Builder → Login Box.
  • The connection has at least one domain, or accepts any email.

Turn on enforcement

  1. Go to [ENVIRONMENT] → Authentication → SSO → Service provider → SSO enforcement.
  2. Turn on the Enforce SSO on tenant access toggle.

The setting applies to every tenant in the environment that meets the prerequisites.

Existing sessions

Sessions created while enforcement was off are sent to the tenant's identity provider (IdP) the next time the user switches tenants or refreshes their session.

What users experience

  • Login - users are redirected to the SSO login page of their tenant.
  • Tenant switch - switching to a tenant with SSO requires authentication through that tenant's IdP. A session that already authenticated through it is allowed through.
  • Session refresh - when a session is refreshed for a tenant other than the one it started in, the same check applies.

Exemptions

These users are not required to use SSO:

  • Users whose email is on the tenant's SSO excluded list. To manage the list, use the Exclude email from SSO API and its related endpoints.
  • Impersonated sessions and super users.

Handle the SSO required error

When access is refused because the tenant requires SSO, Frontegg returns HTTP 400 with error code ER-01253.

Error contextMeaning
ssoRequired: true with addressRedirect the user to address to authenticate through SSO.
ssoRequired: falseAccess to the tenant is refused.

The Frontegg SDK versions listed in the prerequisites redirect the user to the SSO login page for you. If you call the Frontegg APIs directly, handle ER-01253 in your application.