Applications in Kinde
Build on Kinde
Workforce identity in Kinde
Workforce identity lets your team sign in to third-party tools using Kinde as the identity provider. Instead of managing a separate login for every tool your business runs on, you manage people once in Kinde and grant them access to the tools they need.
Kinde acts as a SAML 2.0 identity provider (IdP). When someone on your team opens a connected tool, that tool asks Kinde to verify who they are, and Kinde returns a signed SAML assertion containing their identity and any attributes you choose to send.
Workforce identity vs enterprise connections
Link to this sectionKinde supports SAML in both directions, and it is important to know which one you need.
| Workforce identity | Enterprise connections | |
|---|---|---|
| Kinde’s role | Identity provider (IdP) | Service provider (SP) |
| Who signs in | Your own team | Your customers’ users |
| Where they sign in to | Third-party tools such as Slack or Google Workspace | Your product |
| You configure | The third-party tool to trust Kinde | Kinde to trust your customer’s IdP |
If you want your customers to sign in to your product using their own company IdP, you want enterprise connections. If you want your team to sign in to other companies’ tools using Kinde, you want workforce identity.
Customer identity and workforce identity
Link to this sectionSettings > Environment > Applications is split into two sub-pages.
-
Customer identity holds your OAuth applications, which are the front-end, back-end and machine-to-machine apps that make up your own product. See Applications in Kinde.
-
Workforce identity holds your SAML applications, which are the third-party tools your team signs in to.
The two are managed separately and do not share configuration.
The application catalog
Link to this sectionKinde ships a catalog of around 120 pre-configured SAML applications, so most tools need only a couple of values to connect. The catalog includes Microsoft 365, Google Workspace, Slack and Salesforce, along with many HR, finance and IT tools.
Catalog entries pre-fill what Kinde can know ahead of time, and many include an example SP entity ID, an example ACS URL, and a link to the vendor’s own SAML setup guide.
If your tool is not in the catalog, choose SAML application and enter the values by hand. Any SAML 2.0 service provider will work.
How people sign in
Link to this sectionThere are three ways a connected tool can be opened.
- Service provider initiated — someone goes to the tool directly, and the tool redirects them to Kinde to sign in. This is the most common path.
- Identity provider initiated — someone opens the tool from a tile in the Kinde self-serve portal. See Enable self-service portal for users.
- Test SSO — you open the tool yourself from the Kinde admin to check a connection before rolling it out.
In every case the person signs in to Kinde using whichever authentication methods you have enabled, and Kinde issues the assertion only after they have authenticated.
Controlling who gets access
Link to this sectionAccess to each application is controlled independently, so adding an application does not give it to everyone. Two settings decide who can sign in, and two decide who sees the application tile in the self-serve portal.
Who can sign in
Link to this section- Enabled turns the application on or off. When it is off, nobody can sign in to it.
- Role-based access control restricts sign-in to members holding one of the roles you select.
Role-based access control is evaluated within an organization. If it is enabled and Kinde cannot determine which organization the person is signing in from, access is denied.
Who sees the tile in the self-serve portal
Link to this section- Show on self-serve portal controls whether a tile appears for organization members in the portal.
- Limit to organizations restricts the tile to chosen organizations. Leave it unset to show the tile to every organization.
These two settings affect the portal only. They do not block sign-in. Someone who goes to the third-party tool directly still signs in through service provider initiated SSO, even if their organization is not selected under Limit to organizations.
Single logout
Link to this sectionIf you set a logout URL on an application, Kinde supports SAML single logout for it. When a connected tool sends a logout request, Kinde ends the SAML session for that tool and notifies other connected tools that have logout configured.
Single logout ends SAML sessions only. It does not sign the person out of Kinde, and it does not revoke access or refresh tokens for your own applications. Those end only through an explicit Kinde action such as signing out of Kinde, a credential change, or an admin action.