> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ragsuite.de/llms.txt
> Use this file to discover all available pages before exploring further.

# SSO

> RAGSuite Enterprise SSO with Google OIDC — single sign-on on your infrastructure.

**Edition:** Enterprise

Single sign-on is an Enterprise module. RAGSuite supports **Google OIDC** so your organization can sign in with your existing Google identity provider.

Community password auth and 2FA remain available without SSO — see [Authentication](/Console/Authentication/Index).

<Steps>
  <Step title="Confirm Enterprise entitlement">
    SSO requires an active Enterprise license. Complete [Activation](/Enterprise/Activation/Index) first.
  </Step>

  <Step title="Create a Google OIDC client">
    In Google Cloud Console, create an OAuth client for your RAGSuite console origin and redirect URI. Keep the client ID and secret offline.
  </Step>

  <Step title="Configure SSO in RAGSuite">
    Set Enterprise SSO settings for Google OIDC (client ID, secret, and redirect). Enable SSO only after the redirect URI matches your console URL.
  </Step>

  <Step title="Verify sign-in">
    Open the console, choose Google sign-in, and confirm a user lands in the expected org/project access. Keep password auth available as a break-glass path until SSO is proven.
  </Step>
</Steps>

<Info>
  Env flags such as `SSO_ENABLED` exist in CE templates for wiring; **product SSO requires Enterprise** entitlement and configuration. This documentation covers **Google OIDC only**.
</Info>

## Interactive tour

<Frame>
  <div className="rg-supademo">
    <iframe src="https://app.supademo.com/embed/cmucejn4p0w7vqm06u2zdz33v" title="RAGSuite Google SSO — interactive demo" loading="lazy" allow="clipboard-write" allowFullScreen />
  </div>
</Frame>