# Single Sign-On

Single Sign-On is a **DefectDojo Pro** feature. As of DefectDojo 3.0, the SSO surface — SAML, OIDC, and the bundled OAuth providers — is available only in DefectDojo Pro. Open-source DefectDojo uses local username/password login and the password-reset flow.

If you’re running open-source DefectDojo and want SSO, you’ll need to switch to [DefectDojo Pro](/content/site-root.html); the migration is covered in the [3.0 upgrade notes](https://docs.defectdojo.com/releases/os_upgrading/3.0/#sso-providers-are-available-in-defectdojo-pro-only). Existing user accounts and group memberships are preserved on upgrade. For access control on open-source DefectDojo, see the [Authorized Users](https://docs.defectdojo.com/admin/user_management/os__authorized_users/) page.

## Supported SSO providers (DefectDojo Pro)

DefectDojo Pro supports SAML and the following OAuth providers. Each guide walks through the provider-side setup and the corresponding configuration in the Pro **Enterprise Settings** UI.

- **[Auth0](https://docs.defectdojo.com/admin/sso/pro__auth0/)**
- **[Azure Active Directory](https://docs.defectdojo.com/admin/sso/pro__azure_ad/)**
- **[GitHub Enterprise](https://docs.defectdojo.com/admin/sso/pro__github_enterprise/)**
- **[GitLab](https://docs.defectdojo.com/admin/sso/pro__gitlab/)**
- **[Google](https://docs.defectdojo.com/admin/sso/pro__google/)**
- **[KeyCloak](https://docs.defectdojo.com/admin/sso/pro__keycloak/)**
- **[Okta](https://docs.defectdojo.com/admin/sso/pro__okta/)**
- **[OIDC (OpenID Connect)](https://docs.defectdojo.com/admin/sso/pro__oidc/)**
- **[SAML](https://docs.defectdojo.com/admin/sso/pro__saml/)**

SSO configuration in DefectDojo Pro can only be performed by a **Superuser**.

**DefectDojo Pro users:** Add the IP addresses of your SAML or SSO services to the Firewall whitelist before setting up SSO. See [Firewall Rules](https://docs.defectdojo.com/get_started/pro/cloud/using-cloud-manager/#changing-your-firewall-settings) for more information.

## Disabling Username / Password login

Once SSO is configured in DefectDojo Pro, you may want to disable the traditional username/password login form. Uncheck **Allow Login via Username and Password** under **Enterprise Settings > Login Settings**.

### Login fallback

If your SSO integration stops working, you can always return to the standard login form by appending the following to your DefectDojo URL:

`/login?force_login_form`

We recommend keeping at least one admin account with a username and password configured as a fallback.