Single sign-on

Coaching users can sign in with your corporate identity provider instead of a Retorio password. Your identity provider confirms who the user is and sends Retorio their email address. Retorio signs them in if that address belongs to a coaching user invited into a cohort.

Access needs both sides. Single sign-on establishes identity only. It does not grant access or create accounts. A user must also be invited into a cohort with the same email address your identity provider sends. Enabling your side alone gives nobody access.

Method	Providers
SAML 2.0	Any enterprise identity provider: Entra ID, Okta, Keycloak, Ping and similar. HTTP-POST binding
OIDC	Any enterprise identity provider. Authorization code flow with a client secret
Google	Google Workspace sign-in
Microsoft	Microsoft Entra ID sign-in

Each Retorio organization uses one method. Several Retorio organizations can share one identity provider connection. Setting it up goes through your Retorio contact, and there is no endpoint to configure an identity provider: Setup, then Going live.

Who it covers

Users	How they sign in
Coaching users in cohorts with the Email invitation mode	Through your identity provider
Coaching users in cohorts with the Token invitation mode	On the Token tab, with the Retorio password they set at sign-up, even when single sign-on is enabled
Admins	With email and password, except a Microsoft Marketplace admin, who signs in with their Microsoft account

How sign-in works

1. The user starts at the Retorio login page: from the link in their invitation email, from your organization’s login link, or by entering your organization’s name on the coaching app’s login page.
2. Retorio looks up how that organization signs in (GET /auth/auth_details) and opens your identity provider’s sign-in page in a pop-up.
3. Your identity provider authenticates the user and asserts their email address.
4. Retorio matches that email against an already-invited user. On their first sign-in the user accepts the Terms of Service and privacy policy once, and the coaching app completes their sign-up (POST /auth/coaching_sso_signup). After that they are signed in directly.
5. An email that was never invited, or whose invitation expired before the user completed sign-up, is turned away, not provisioned. An invitation expires after 60 days. Resend it.

What a user experiences

Step	What happens
Invitation	They receive an invitation email after being added to a cohort
Sign-in	The invitation link or the login link takes them to the sign-in button. They sign in at your identity provider in a pop-up
First visit	They accept the Terms of Service and privacy policy, once. Their name is taken from your identity provider where it sends one, at this first sign-in only
Coaching	They land on the programs assigned to their cohorts

Not supported

Item	Instead
Identity-provider-initiated sign-on	Sign-in starts at the Retorio login page. App tiles in Entra My Apps, the Okta dashboard or similar portals do not sign users in
Encrypted SAML assertions	Send assertions unencrypted
SCIM provisioning	Users are invited into cohorts and removed from the organization, in the admin app or through the API
Single sign-on for admins	It applies to coaching users only
Directory or mailbox access	Retorio does not read mailboxes, calendars or your directory, and does not call Microsoft Graph. From sign-in it takes the user’s email address, and their name where your provider sends it. If a Microsoft consent screen lists “Sign in and read user profile” (User.Read), Retorio does not use it