单点登录 (SSO)
了解你的企业组织如何使用你的身份提供者来管理团队中的 Expo 用户。
企业计划 客户可以使用单点登录 (SSO)。
¥Single Sign-On (SSO) is available for Enterprise plan customers.
要开始，请为 Expo SSO 准备你的身份提供者 (IdP)，并按照下面的 IdP 配置指南 收集信息。完成此操作后，你组织的所有者可以按照指示执行 启用 SSO。
¥To get started, prepare your identity provider (IdP) for Expo SSO and gather information by following the configuration guide for your IdP below. Once you have done this, an owner of your Organization can follow instructions to enable SSO.
如果你有疑问或问题，请联系 联系我们，我们将帮助你设置组织。
¥If you have questions or issues, contact us and we'll help you set up your organization.
身份提供商支持
¥Identity provider support
Expo SSO 支持以下身份提供商：
¥Expo SSO supports the following identity providers:
我们实现 OpenID 连接发现 1.0 规范，并正在努力验证其他兼容的身份提供商。如果你使用其他身份提供商并且对 SSO、让我们知道 感兴趣。
¥We implement the OpenID Connect Discovery 1.0 specification and are working to verify additional compatible identity providers. If you use another identity provider and are interested in SSO, let us know.
在组织上设置 SSO
¥Setting up SSO on an organization
1
Log in as the Organization account owner. In your account's EAS dashboard, go to Settings > Organization settings > Create SSO configuration for account.
2
On Create SSO configuration for account, click the Start button.
3
Enter the configuration details for your IdP using the information you collected during the IdP setup:
- Client ID
- Client secret
- IdP subdomain/tenant ID, if needed. Click the ? icon above the Issuer field for help with what to enter.
4
Click Create SSO Configuration.
5
The Organization settings > Overview page will now display an Update SSO configuration option. Use this option to update the client secret if it changes.
SSO user sign in
Expo website
1
Navigate to expo.dev/sso-login and enter the account name of your organization. You can create a link that pre-fills the organization name. For example, expo.dev/sso-login/test-org pre-fills test-org.
2
Log in to your identity provider (IdP).
3
You'll be prompted to select an Expo username. This will be the username for your Expo account.
Expo CLI
When using the Expo CLI, you can run the following command to log in to your Expo account.
- npx expo login --ssoYou will be prompted to log in via the Expo website in a browser and will be redirected back to the CLI upon completion.
EAS CLI
When using the EAS CLI, you can run the following command to log in to your Expo account.
- eas login --ssoYou will be prompted to log in via the Expo website in a browser and will be redirected back to the CLI upon completion.
Expo Go
1
Click the Continue with SSO button on the sign-in page when going through the sign-in flow.
2
Follow the above steps to sign in to the Expo website.
SSO user restrictions
SSO users are like regular users. However, there are a few known exceptions:
- SSO users can only belong to their SSO organization. They also cannot create additional organizations.
- SSO users cannot leave their SSO organization. Doing so deletes their SSO user.
- SSO users cannot log in to the Expo forums.
- SSO users cannot subscribe to EAS for their personal accounts.
SSO administration
Both new organizations and existing organizations can enable SSO as a sign in option. Organizations with existing non-SSO members can enable SSO and then direct new members to the SSO sign-in page, while existing users continue to use their current Expo credentials. To support external contributors, SSO-enabled organizations also allow inviting additional non-SSO users via email.
Transitioning existing users to SSO
Regular users may be a member of one or many personal, team, and organization accounts while SSO users belong exclusively to their organization account. Thus, existing users cannot be directly converted into SSO users. However, a regular user who's already a member of your organization may create a second user by going to the SSO login page. Then, their regular user can be removed from the organization.
To transition from using a regular Expo account to an SSO account, follow these steps:
1
Check if you're already logged in at expo.dev. If so, log out.
2
Go to the SSO login page and follow the prompts, such as entering your organization name, creating a new Expo username, and logging in to your identity provider.
3
By default, your new SSO user will have the View Only role. If you need a different role, ask an Admin or Owner to update your role in Members settings.
4
Run eas login --sso to switch to your new account on the CLI.
5
At this time, the Admin or Owner can remove your old user from the organization. In Members settings, the list of organization members indicates whether a user is an SSO or non-SSO user. The Admin or Owner can click the dropdown next to the old user and click Remove member.
6
If you no longer need your old user account, log out of your new SSO account, then log in to your old account and go to User settings. Scroll down and click Delete Account. Note that this will delete any projects under your old user account. It will not affect any projects owned by the organization.
If you wish to reuse your old username on your new SSO user account, you can go to User settings under your old user and rename it before creating your SSO account. Alternatively, you can rename your SSO user account's Expo username after deleting your old user. While Expo usernames need to be unique, it is OK if your email address on your identity provider matches the email address of your old user.
Remove SSO users
If someone has left your organization, remove or disable them in your IdP. Depending on the token refresh duration you configured with your IdP, the removed user will subsequently lose access to their Expo account. If you wish to remove them ahead of that time or you wish to remove them to clean up users on your account, you may do so on the organization Members settings page:
1
Navigate to your organization account Members settings.
2
Click the dropdown next to the member you wish to delete, and click Delete SSO user.
This will delete their personal account and all data associated with it. All data in your organization account will remain unaffected.
更改计费或停止使用 SSO
¥Change billing or discontinue use of SSO
需要有效的企业计划才能继续使用 SSO。联系我们 如果你希望停止使用 SSO 或更改你的计划。
¥An active Enterprise Plan is required to continue using SSO. Contact us if you wish to discontinue the use of SSO or change your plan.
为了确保无论是否启用 SSO，都能不间断地访问你的组织，SSO 组织必须保留至少一名具有所有者角色的非 SSO 用户作为成员。
¥To ensure uninterrupted access to your organization whether or not SSO is enabled, SSO organizations must keep at least one non-SSO user with the Owner role as a member.
删除 SSO 组织
¥Delete SSO organization
为组织配置 SSO 后，Expo 团队必须手动完成账户删除。联系我们 寻求帮助。
¥Once SSO is configured for an organization, account deletion must be done manually by the Expo team. Contact us for assistance.