Sign-in methods and single sign-on

You can sign in with a password, with a one-time sign-in link by e-mail, with a passkey, with a provider such as Google or Microsoft, or through your organization’s single sign-on. You see and manage your methods on the profile page under Sign-in methods; two-factor sign-in adds a code from an authenticator app.

Ways to sign in

• Password – at least 10 characters.
• E-mail me a sign-in link (on the sign-in page: Forgot password? E-mail me a sign-in link) – a one-time link instead of a password, handy for volunteers. The link opens a page with a Sign in button: e-mail security programs open links before you do, so only your click signs you in. The same e-mail carries a 6-digit code: if you use Contals as an app on your phone’s home screen, the link would open the browser instead – type the code on the sign-in page of the app. The code works once, for 10 minutes, and only as long as the link of the same e-mail has not been used. If you have two-factor sign-in on, the link and the code still ask for your second factor.
• Forgot your password? Sign in with the link or the code. For the next 30 minutes, profile → Password lets you set a new password without the old one. Your other devices are then signed out, and you get an e-mail about the change.
• Continue with Google, Continue with Microsoft and other providers that are set up for Contals. A provider is only used with an e-mail address it has confirmed; otherwise Contals sends its own confirmation link first.
• Continue with SSO – enter your work address and you are sent to your organization’s identity provider.
• Sign in with a passkey – your fingerprint, your face or the PIN of your device instead of a password, once you have added a passkey on your profile.

The join page of a group invite link offers the same ways: Google, Microsoft and the other providers, and Continue with SSO. A new account you create there joins the team right away.

Contals is for people aged 16 and older, younger people with the consent of a parent or guardian. You confirm this with a checkbox when you sign up; if your account came through a sign-in link, a provider or SSO, Contals asks once, on a page of its own, after your first sign-in. Contals never asks for a birth date.

Your sign-in methods

Profile → Sign-in methods lists your password, the providers you connected and SSO, with their dates.

• Connect a provider (for example Connect Google) – only one with the same, confirmed e-mail address.
• Disconnect a provider; the last method cannot be removed, and you need a recent sign-in for it.
• Set a password if your account came through a provider – unless your organization requires SSO for your address.

Single sign-on for your organization

Organization owners set up SSO on the organization settings page under Security · Single sign-on (SSO) (admins can read it). SSO is part of every paid plan (Team and Business), at no extra charge; a connection that is already on keeps working after a downgrade, so nobody is locked out.

1. Verified domains – Add domain (for example example.org), publish the TXT record shown at your DNS provider and choose Check now. A verified domain covers its subdomains.
2. Identity provider – choose OpenID Connect (Issuer URL, Client ID and Client secret; copy the redirect URI shown into your identity provider) or SAML 2.0 (paste the identity provider’s metadata or its URL; copy the ACS URL and the entity ID shown into your identity provider). Tick Connection active and Save connection.
3. Create accounts on first sign-in (just-in-time) – people of a verified domain get an account on their first sign-in and join the workspace and role you choose. Without it, only invited people can sign in.
4. Require SSO for addresses of the verified domains – passwords, sign-in links and other providers stop working for these addresses. You can switch this on only after one successful sign-in through the connection. Organization owners keep their password and sign-in links as an emergency way in (for example when the identity provider is down): every such sign-in is logged, listed under Emergency sign-ins and e-mailed to all owners and admins of the organization. Admins who are not owners need SSO.

Client secrets are stored encrypted. Every change to SSO and every SSO sign-in is recorded in the audit log.

Two-factor sign-in and passkeys

On your profile, Two-factor sign-in adds a code from an authenticator app to every sign-in except your organization’s own single sign-on, with single-use recovery codes for a lost phone; Passkeys sign you in with your fingerprint, face or device PIN. Organization owners can require two-factor sign-in of everyone who works in the organization. How to set it up, sign in and recover: two-factor sign-in and passkeys.