Set up sign-in and SSO for every workspace on self-hosted Plane

Sign-in and SSO

0:02On a self-hosted instance, you set up sign-in in one place, God mode's Authentication page, for every workspace at once.

0:12It decides who can create an account, and which sign-in methods people can use, including Google and single sign-on through your identity provider.

0:22You'll choose who can sign up, switch on the methods your company uses, and see which ones need a plan. Let's take a closer look.

Decide who can sign up, and how

0:35To change how people sign in, open God mode, at your domain /god-mode, then Authentication.

0:44The first switch, Allow anyone to sign up even without an invite, controls who can create an account.

0:52A new instance has it on. Anyone who reaches your domain can sign up with an email and a password, and create a workspace of their own.

1:02Turn it off, and only people invited to a workspace can sign up. Everyone who already has an account still signs in.

1:10The first method, Unique codes, emails a six-digit code that works once, within ten minutes. It needs a mail server, set in God mode under Email.

1:22Passwords lets people sign in with their email and a password. A new instance has Passwords on and Unique codes off.

Add Google, GitHub, GitLab, or Gitea

1:34Google, GitHub, GitLab, and Gitea work on every plan. Each card shows Configure until you add its details.

1:44Choose Configure next to Google. The page has two halves: what Google gives Plane, and what Plane gives Google.

1:53Plane's half lists an Origin URL and Callback URIs. They come from the address in your browser, so open God mode at your team's domain before you copy them.

2:04There's a Callback URI for the web app, the mobile and desktop apps, and God mode's own sign-in. Register the ones your team uses.

2:14In Google's console, create an OAuth client for a web application. Paste the Origin URL into Authorized JavaScript origins, and those Callback URIs into Authorized redirect URIs.

2:28Google then gives you a Client ID and a Client secret. Enter both in Google's half, and choose Save changes.

2:37Saving alone leaves Google off. Turn on its switch, and the sign-in page shows Sign in with Google.

2:45Plane doesn't limit Google sign-in to your company's domain. With sign-up invite-only, someone new still needs a workspace invitation, whichever button they use.

2:56GitHub takes a Client ID and Client secret from a GitHub OAuth app, and an optional Organization ID that lets in only that organization's members.

3:07GitLab and Gitea work the same way, plus a Host: gitlab.com or gitea.com, or your own server's address.

Connect your identity provider

3:20Single sign-on connects Plane to the identity provider your company already runs, over OIDC or SAML, or to your LDAP directory.

3:32OIDC and SAML need a paid plan. One workspace on Pro or Business makes them available across the instance, and Enterprise Grid includes them.

3:44LDAP needs Enterprise Grid, the one key for the whole instance. Without the plan they need, the three cards show an Activate button instead of Configure.

3:55With a plan active, OIDC's form has the same two halves as Google's. Register Plane's Origin, Redirect, and Logout URLs with your identity provider.

4:07From your provider, enter the Client ID, the Client secret, and the Authorize, Token, and Users' info URLs.

4:16IdP's name sets the label on the sign-in button. Save changes, then turn OIDC on.

4:24SAML works the same way, with your provider's Entity ID, SSO URL, and certificate.

4:32LDAP checks a person's directory username and password against your LDAP server, so that server must be reachable from Plane.

4:42Its form takes the Server URI, a Bind DN and Bind Password to search with, and the User Search Base.

4:51Plane finds accounts by email address, so people keep their accounts when they move to single sign-on with the same email.

4:59To make single sign-on the only way in, switch off Passwords, Unique codes, and every other method.

5:07That choice covers the whole instance. No workspace setting enforces single sign-on.

5:14God mode won't switch off the last method. It also keeps a password sign-in for instance admins, so you can't lock yourself out of it.

Recap

5:24The Authentication page sets sign-in for every workspace. It decides who can sign up, offers codes, passwords, and four providers on any plan, and single sign-on with a paid plan.