Why can't I find the allowed-domains field in the SSO settings?

Why this happens

The domains list only matters when Cyberlop creates accounts on its own. So the page hides the field until you ask for that. The option reads: anyone your identity provider signs in with a verified email on the domains below gets a Cyberlop account, as long as your plan has a free user seat.

If you never tick the box, you never need the field.

How to fix it

1. Open Settings and choose Single sign-on in the left-hand list.
2. Tick Create accounts automatically on first sign-in.
3. Look below the box. The allowed-domains field appears.
4. Enter the email domains you trust. Only people whose verified email matches those domains get an account.
5. Click Save single sign-on settings.

Still not working?

The checkbox to enable single sign-on stays off until a client secret is saved. Fill in Issuer URL, Client ID and Client secret first. Our capture did not show the field itself, so its exact label may differ from what we describe.

Consider the safer choice. The option Require an admin-bound SSO subject is recommended and on by default. It asks an admin to set each user's immutable subject before first sign-in. Read how auto-create accounts work and why no account was created, or write to us. The glossary covers single sign-on.

Related questions

• How do I let new people get accounts automatically through SSO?
• Why didn't a new SSO user get an account automatically?
• How do I set up single sign-on with my identity provider?
• Why can't I tick "Enable single sign-on"?
• What does "Require an admin-bound SSO subject" do?

Full tutorial

Single sign-on: set up OIDC, the redirect URI and account binding

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre