> For the complete documentation index, see [llms.txt](https://lewe.gitbook.io/teamcal-neo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lewe.gitbook.io/teamcal-neo/user-guide/oidc-authentication.md).

# OIDC / SSO Login

If your administrator has enabled Single Sign-On (SSO), you can log in to TeamCal Neo using your organisation's Identity Provider (IdP) — for example Microsoft Entra, Okta, or Keycloak — instead of a TeamCal Neo password.

***

## Logging in with SSO

1. Open the TeamCal Neo login page.
2. Click the **Login with SSO** button.

   You will be redirected to your organisation's login page. TeamCal Neo never sees your password — authentication happens entirely at your IdP.
3. Enter your credentials at the IdP. If your organisation requires multi-factor authentication (MFA), you will be prompted there.
4. After successful authentication you will be redirected back to TeamCal Neo and logged in automatically.

{% hint style="info" %}
Your TeamCal Neo username must match the username your organisation's Identity Provider sends. If you are unsure what that is, contact your administrator.
{% endhint %}

***

## What if login fails?

| Message shown                                           | What it means                                                                                                                         |
| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| **No local account found. Contact your administrator.** | You authenticated at the IdP successfully, but no TeamCal Neo account exists for your username. Ask your administrator to create one. |
| **Account disabled**                                    | Your TeamCal Neo account has been locked by an administrator.                                                                         |
| **Account not verified**                                | Your TeamCal Neo account is pending verification.                                                                                     |
| **OIDC: Provider connection error**                     | TeamCal Neo could not reach the Identity Provider. Contact your administrator.                                                        |

***

## Two-factor authentication

When SSO is active, TeamCal Neo's built-in two-factor authentication (TOTP) is **not used**. Any second factor (MFA) is handled by your organisation's Identity Provider during the IdP login step. You do not need to set up or enter a TOTP code in TeamCal Neo.

{% hint style="info" %}
The 2FA setup page in your profile will display a notice that two-factor authentication is managed by the Identity Provider when SSO is active.
{% endhint %}

***

## Logging out

Clicking **Logout** in TeamCal Neo clears your TeamCal Neo session. Your session at the Identity Provider remains active. This means:

* You will need to click "Login with SSO" again to return to TeamCal Neo.
* If your IdP session is still valid, you may be logged back in immediately without being prompted for credentials again.

To end your IdP session as well, log out from your organisation's IdP portal separately.