{
  "name": "internet-identity-sso",
  "title": "Internet Identity Enterprise SSO",
  "category": "Auth",
  "description": "Set up an organization's own single sign-on for Internet Identity, so staff sign in to II-powered apps against Okta, Entra ID, Google Workspace or Auth0. Nothing registers with II: it discovers the configuration from /.well-known/ii-openid-configuration on the organization's domain. Covers the OIDC client, the discovery file and every field, per-app clients including salted-hash keys, gate_all_apps, stable_identifier_claim, the limits that reject the whole file, and II's caching windows. Use when an organization wants its employees to sign in with its own identity provider, when II offers no SSO for a domain that has published the file, or when an edit to that file has not taken effect yet. This is the organization's side, done by whoever administers the domain. For an app sending users there with ssoDomain, load internet-identity. Do NOT use for signing in to II with a personal Google, Apple or Microsoft account, which is ordinary OpenID and needs none of this.",
  "license": "Apache-2.0",
  "compatibility": "an OIDC provider (Okta, Entra ID, Google Workspace or Auth0), HTTPS hosting for the organization's domain",
  "updated": "2026-11-06T11:13:33.000Z",
  "urls": {
    "html": "https://skills.internetcomputer.org/skills/internet-identity-sso/",
    "markdown": "https://skills.internetcomputer.org/.well-known/skills/internet-identity-sso/SKILL.md",
    "json": "https://skills.internetcomputer.org/api/skills/internet-identity-sso.json",
    "source": "https://github.com/dfinity/icskills/blob/5b70e9d86495af101c8d683fafb2bdfad7d2a578/skills/internet-identity-sso/SKILL.md"
  },
  "publisher": {
    "name": "DFINITY Foundation",
    "url": "https://dfinity.org"
  },
  "canonicalRepo": {
    "name": "dfinity/icskills",
    "url": "https://github.com/dfinity/icskills"
  }
}