About Kinde authentication
Auth and access
Provisioning users for enterprise connections
When you set up Kinde with enterprise authentication like SAML or Cloudflare, you’ll want to make sure that users are set up with the correct access and identity from day one. How you do this depends on how you ‘provision’ their enterprise user identity.
Users in Kinde are able to have multiple identities to support all the ways they can sign in, such as via email, social sign-in, etc. However, users managed through enterprise connections can only have an enterprise identity.
Just-in-time (JIT) provisioning for user creation (recommended)
Link to this sectionJIT provisioning is the simplest way to add users to Kinde and allow them to authenticate. Rather than importing or pre-provisioning, your users are added to Kinde at the point of their first authentication.
To enable JIT provisioning, select the Create a user record in Kinde option when you set up your enterprise connection.
The first time the user authenticates, Kinde creates a new user record for them with the identity information passed from your IdP.
Pre-provision or pre-create users
Link to this sectionSometimes, JIT provisioning is not the right path or may not be possible. For example:
- The user already exists in Kinde and you’re switching the auth method to SSO.
- You are importing users from another system and there is existing data related to the user you also wish to import.
- You only want to add a sub-set of users from your directory.
Add users to Kinde
Link to this sectionIn all these cases, the users must first exist in Kinde to implement enterprise SSO.
You can add users to Kinde via import or via API.
All users must have an email address that matches their email with the IdP. This is not necessarily the email identity for sign in, it is purely for initial matching against the IDP provided email.
Provisioning method 1: Assign a connection identity to a user (recommended)
Link to this sectionThis method of provisioning requires you to add the enterprise connection as part of the user’s identity in Kinde.
Add the enterprise connection identity via API
Post identity details to this endpoint POST /api/v1/users/{user_id}/identities with enterprise as the type and the connection_id. For more information, see Create identity.
You can search connections via API and filter them by domain. This can help you obtain the connection ID.
Add the enterprise connection identity manually
- Open a user’s profile and select Add identity.
- In the window that appears, select Enterprise SSO as the Identity type.
- Select the relevant Enterprise connection from the list.
- Enter the user’s email as it appears in the identity provider directory.
- Select Save. The user’s profile is updated to show only the enterprise connection identity.
Provisioning method 2: Link users by email address
Link to this sectionInstead of adding and linking each user manually as per method 1 above, you can let Kinde link the enterprise identity to the pre-provisioned user when the email address from your identity provider matches. Note that linking overrides any existing identity information in Kinde (such as email or phone number) with the connection data from the identity provider.
This method requires an environment-level connection. Organization-level connections show Auto-add users instead of Email address trust. Open the connection configuration (Settings > Environment > Authentication, then under Enterprise connections, select Configure) and under Provisioning, set Email address trust to Verify, then trust (recommended) so Kinde asks the user to verify the address with a one-time code before combining the accounts, or Trust to combine them straight away if your identity provider verifies email addresses and prevents users from changing them.
Once the users are combined, their original email identity is removed and they can only authenticate via the SSO connection. For details about the trust options, see Trusting emails from providers.
Troubleshoot SSO issues
Link to this sectionWe can’t find your account
If a user goes to sign in and encounters the ’We can’t find your account’ message, it could be because Self-joining for the organization is switched off. This is the right behaviour if you don’t want users without the org_id to join the org, but the message is confusing. Switch this on via Organization > Policies.
Duplicate identities
If duplicate identities are created for users in Kinde, it may be because Email address trust is set to Don’t trust in the connection configuration. Set it to Verify, then trust (or Trust, if your identity provider meets the conditions in Trusting emails from providers) so matching email addresses can be linked to the existing user.
Customer’s SSO auth not working
Some B2B businesses allow their customers to sign in using their own enterprise SSO. When setting this up, a common mistake is that they supply incorrect values for the Client ID and Client Secret, based on the identity provider information. Double check these if you come across connection issues.
Automated provisioning with SCIM
Link to this sectionIf your identity provider supports SCIM 2.0, such as Microsoft Entra ID, Okta, or Google Workspace, you can have it create, update, and suspend users in a Kinde organization automatically. Users provisioned with SCIM get an enterprise identity on the organization’s enterprise connection, so they can sign in with SSO straight away, and you can link IdP groups to Kinde roles.
SCIM is set up per organization, under Organizations > [organization] > Provisioning > Directory. Once an organization uses SCIM, its users and roles are managed from your identity provider and are read-only in Kinde.
For setup steps, see Sync users from your identity provider with SCIM.