Getting started with Krisp SSO

Overview

Single sign-on (SSO) lets you log in to Krisp using your company credentials. Krisp's SSO is based on SAML 2.0.

Krisp acts as the Service Provider (SP) and offers automatic user provisioning, so team members don't need to register with Krisp in advance. When Krisp receives a SAML response from the Identity Provider (IdP), it checks whether a user with the received email address already exists in the Krisp team account. If the user does not exist, Krisp creates one automatically with that email and assigns it to an available unassigned seat in the team. If there is no unassigned seat at the time of the user's first sign-in, the sign-in attempt is rejected.

Because Krisp implements the generic SAML protocol, it is compatible with a wide range of Identity Provider services, including Okta, Microsoft Entra ID, JumpCloud, Google Workspace, and any other service that supports SAML 2.0. For step-by-step instructions for your provider, see Setup guides by identity provider.

General instructions for team Admins

To start the SSO setup, it must first be activated for your team account. Once it is activated, follow the steps below:

1. Go to your Admin Portal on account.krisp.ai.
2. Go to the Authentication section from the Security tab.
3. Enable SSO.
   
   

If you select the Enforce SSO checkbox, SSO becomes the only sign-in option for your team members. See this article for more about the Enforce SSO option.

To complete the SSO configuration:

1. Configure your IdP to send the email address of your team member to Krisp as an identifier for the account.
2. In your Admin Portal, where SSO is enabled, click SAML and enter the information from your IdP in the Configure SAML panel.
   
   

3. Enter the following information from your IdP in the Configure SAML panel of the Krisp Admin Portal:

   • Audience URI
   • Identity Provider Single Sign-On URL
   • Identity Provider Issuer
   • X.509 certificate.

   Once all the information is entered, click Configure.
   
   

Now you and your team members can sign in with SSO using your team slug and your company IdP credentials.

All team members can also sign in with your company email, since the company domain is detected automatically. See this article for more information.

Setup guides by identity provider

Setup steps differ depending on whether you manage a single team or an Organization with multiple teams. Organization Admins can set one Org-level SSO policy that applies to the teams below them, instead of configuring SSO for each team separately. If you manage several teams from one place in the Admin Portal, use the Organization guide. Learn more about Organizations in Krisp.

Using a different provider? Any identity provider that supports SAML 2.0 works with Krisp SSO. Follow the general instructions for Admins above.

Change the in-app SSO slug after installation

To learn more about deploying Krisp for SSO-enabled teams, see this article.

As an Admin, once you update the SSO slug from the Admin Portal, you can change it in the app as well by using one of these options:

• Change from the JSON body
  Open the key.config file in the ProgramFiles/Krisp folder and change the sso_slug property in the JSON body.
• Change via a repair MSI action using a different sso_slug
  Run the same MSI installer with the new slug as a parameter. It overrides the sso_slug value in key.config.
• Change during an update
  When installing the new version, specify a new sso_slug value in the installer parameter, and the value is overridden during the update.