Sign-in policy

The sign-in policy decides who at your institution may complete single sign-on, beyond what the identity provider itself allows.

Before you start

• You need the manage institution permission.
• Open Administration → Sign-in policy.

Allowed email domains

Your institution’s own domain is always allowed. Additional allowed email domains takes a comma-separated list of extra domains, up to 50. Subdomains are not implied: list law.example.edu as well as example.edu if both should sign in. The read-only Sign-in is allowed from list shows the result.

A user whose email domain is not allowed is refused at sign-in even if the identity provider accepts them.

Link existing accounts by email

Link existing accounts by email is off by default. It matters when someone signs in for the first time from an identity that Unifuse has not seen, but whose email address already belongs to a Unifuse account (for example an account created earlier through SCIM, or after the institution changed identity providers).

• Off: the sign-in is refused, so an identity cannot take over an existing account by sharing its email address.
• On: the identity is linked to the existing account and the link is recorded in the audit log.

Turn it on during an identity-provider migration, then turn it off again.

Notes

• Changes apply from the next sign-in.
• OIDC sign-ins require the identity provider to report the email address as verified.