# Single sign-on

Ripple Custody (Wallet) supports single sign-on (SSO) using a third-party login.

SSO lets your team authenticate through your organization's existing identity provider (for example, Google, Okta, or PingFederate) instead of a separate Ripple Custody (Wallet) username and password. This can greatly simplify the sign-in process.

Configure SSO before inviting users
The authentication method is permanently locked to each user at invite time. If your organization uses SSO, complete this setup **before** you send any invitations. See [Manage users](/pt-br/products/wallet/organization-and-access/users-and-roles/manage-users) for invitation steps.

### When to use SSO with Ripple Custody (Wallet)

Use SSO when your organization:

* Uses a centralized identity provider (Google Workspace, Okta, PingFederate, or another SAML or OIDC provider)
* Requires consistent authentication policies and sign-in controls across all internal tools
* Wants to reduce password fatigue for team members
* Needs centralized access revocation when employees leave
* Is confident in its existing security posture and SSO configuration


### When not to use SSO with Ripple Custody (Wallet)

* You want to segregate both authentication and authorization from your organization's single sign-on
* You aren't confident that your organization's SSO controls are strong enough to also protect your access to Ripple Custody (Wallet)


**Important:** Once you switch to using SSO with Ripple Custody (Wallet), you're responsible for securing your SSO access and for having adequate governance controls in place to prevent unauthorized access to Ripple Custody (Wallet).

## Supported identity providers

Ripple Custody (Wallet) provides built-in support for the following identity providers:

| Provider | Protocol |
|  --- | --- |
| **Okta** | OIDC |
| **ADFS** | SAML |
| **Entra ID** | OIDC |
| **Google Workspace** | OIDC |
| **Keycloak** | SAML |
| **PingFederate** | SAML |


If your provider isn't listed, select **Custom SAML** or **Custom OIDC** to configure a connection manually. Use these options for Azure AD B2C, or to connect Entra ID over SAML instead of OIDC.

## Configure SSO for your organization via the console

Owner role required
Only users with the **Owner** role can set up SSO. Other roles, including Administrator, don't see **Add new method** under **Settings** > **Security**. If you don't see it, ask an owner in your organization to complete these steps.

Prerequisites
You need administrator access (or equivalent) on your identity provider, and the Owner role in Ripple Custody (Wallet). Only owners can add, remove, or change authentication methods.

If the console can't generate a setup link, contact your Ripple representative to use SSO.

1. Go to **Settings** > **Security**.
2. In the **Authentication methods** section, username/password is displayed as the default authentication method. Select **Add new method**.
3. A dialog appears with the heading **Create a connection using the link**. Ripple Custody (Wallet) generates a one-time setup link.
4. Select **Create connection**. This opens a new browser window with the Auth0-hosted setup assistant. Ripple Custody (Wallet) uses Auth0 as the identity broker, so Auth0 stores the credentials, certificates, and metadata you configure on Ripple Custody (Wallet)'s behalf.
5. Select **Get Started**. On the **Select Your Identity Provider** page, choose your provider (or select **Custom SAML** or **Custom OIDC**).
6. Follow the setup wizard to connect your SSO platform to Ripple Custody (Wallet).
Once complete, the new authentication method appears in the **Authentication methods** table.
7. Set the new authentication method as the default. See [Set the default authentication method](#set-the-default-authentication-method-via-the-console).
8. Invite users as normal, using their existing SSO email address. See [Manage users](/pt-br/products/wallet/organization-and-access/users-and-roles/manage-users#invite-a-new-user-via-the-console).
9. The user accepts their invitation as normal and signs in to Ripple Custody (Wallet) by selecting **Continue with SSO**.


SSO login screen
Setup link expiry
After you open the setup link, you have **5 hours** to complete the setup, and you can access the link a maximum of **10 times**. If it expires before you complete the setup, you must create a new authentication method and generate a fresh link.

Provider-specific setup
Each provider has its own configuration steps in the setup assistant. You typically need values from your identity provider, such as a client ID, client secret, domain, or metadata URL. Refer to your provider's documentation for details on creating an SSO application.

## Manage authentication methods via the console

**Required role:** Owner. Other roles don't see the **Actions** menu in the **Authentication methods** table.

After you configure SSO, your new method appears in the **Authentication methods** table on the **Security** page. The table shows:

| Column | Description |
|  --- | --- |
| **Method** | The authentication method name (for example, "Username / Password" or your SSO provider name) |
| **Identifier** | The connection identifier |
| **IDP** | Whether IdP-initiated sign-in is enabled for a Custom SAML method (Enabled or Disabled) |
| **Action** | Actions menu for managing the method |


### Set the default authentication method via the console

The default method determines how new users authenticate when you send them an invitation. New invitations use the default method automatically.

1. Go to **Settings** > **Security**.
2. In the **Authentication methods** table, find the method you want to use as the default.
3. Open the **Action** menu (three dots) for that method and select **Use as default**.


Important
Set the default method before you send an invitation. Once a user has been invited to Ripple Custody (Wallet), you can't change the authentication method they use.

If you want the authentication method to vary depending on which user you're inviting, change the default authentication method to the method you want before you send each invitation.

### Enable or disable IdP-initiated sign-in via the console

For a **Custom SAML** method, you can let users start sign-in from your identity provider, for example from an application tile in your provider's portal (IdP-initiated sign-in). The **IDP** column in the **Authentication methods** table shows whether IdP-initiated sign-in is enabled.

1. Go to **Settings** > **Security**.
2. In the **Authentication methods** table, find the Custom SAML method.
3. Open the **Action** menu and select **Enable IDP** or **Disable IDP**.


Disabling IdP-initiated sign-in doesn't stop users from signing in with **Continue with SSO** on the Ripple Custody (Wallet) sign-in page.

### Remove an authentication method via the console

1. Go to **Settings** > **Security**.
2. In the **Authentication methods** table, find the method to remove.
3. Open the **Action** menu and select **Remove method**.


Restrictions
You can't remove the default authentication method or the built-in username/password method. Change the default to a different method first if you need to remove the current default.