Sign-in & SSO

Learn which sign-in methods Syfo supports, and how organization admins turn on Feishu, WeCom, or CAS single sign-on for members.

Syfo accounts are personal, and one account can join multiple organizations. Sign-in methods come in two kinds:

• Account sign-in methods: Email and password, or Google. These work in every organization.
• Organization single sign-on (SSO): Feishu, WeCom, or CAS. Each organization configures these on its own, and members sign in from that organization’s dedicated sign-in page.

Sign-in methods at a glance

Method	Where you sign in	Who turns it on
Email and password	“Sign in to Syfo” on the sign-in page	Always available
Google	“Continue with Google” on the sign-in page	Depends on whether the Syfo deployment offers it; if you don’t see the button, it isn’t available right now
Feishu	“Continue with Feishu” on the organization sign-in page	Configured by an organization Owner or admin
WeCom	“Continue with WeCom” on the organization sign-in page	Configured by an organization Owner or admin
CAS single sign-on	“Continue with CAS” on the organization sign-in page	Configured by an organization Owner or admin; the CAS server address is provided by the deployment

Sign in with email and password

1. Open the “Sign in to Syfo” page, enter your email and password, and click “Sign in”.
2. If you forget your password, click “Forgot password?” and follow the link in the email to reset it. After a reset, you’re signed out on your other devices.
3. New users click “New here? Create an account” to sign up. You need to verify your email before you can sign in. Passwords must be 8 to 128 characters and include at least one letter and one number.

Note

If the sign-up page shows “Sign-up is closed”, self-service sign-up is turned off for this deployment. Sign in through your organization’s single sign-on, or ask an organization admin to invite you.

Sign in with Google

Click “Continue with Google” on the sign-in page.

If a Syfo account is already registered with that Google email, Syfo won’t merge the two automatically. Sign in the way you originally did, then go to “Settings → Account → Login methods” and click “Connect Google”. Your Google email must match your Syfo account email.

Sign in from your organization’s page (SSO)

Once an organization turns on SSO, members sign in from that organization’s sign-in page, not the general sign-in page:

1. On the sign-in page, click “Use an organization login method”.
2. In “Organization login link or organization code”, paste the organization’s sign-in link, or just the organization code (the part after /s/ at the end of the link), then click “Continue to organization sign in”.
3. On the “Sign in to this organization” page, click “Continue with Feishu”, “Continue with WeCom”, or “Continue with CAS”.

If you don’t know the organization code, click “Don’t know the organization code? Recover by email” and enter your account email. Syfo emails you the sign-in links for the organizations you can access.

The first time you sign in with SSO, if a Syfo account already exists for that email, you’re asked to confirm once with an email verification code, your password, or your current signed-in session. After that, the accounts are linked automatically. You can see linked accounts later in “Settings → Account → Third-party login”.

Tip

SSO is used only to verify your identity. Syfo doesn’t read your Feishu or WeCom messages or contacts.

Turn on SSO for your organization (admins)

Requirements

Syfo must first enable organization SSO for your organization. Until then, “Login & identity” doesn’t appear in “Settings”. If you want to use it, contact us to have it enabled.

Once it’s enabled, the organization’s Owners or admins can configure it in “Settings → Organization → Login & identity”. Regular members and guests don’t see this section.

Setup steps

Each method has step-by-step instructions on the page, and the overall flow is the same:

1. In “Login & identity”, choose Feishu, WeCom, or “CAS single sign-on”, and click “Configure”.
2. Follow the on-page instructions to finish setup on the provider’s platform, and enter the callback URL shown on this page there (for WeCom, the “Trusted domain”).
3. Back in Syfo, enter the credentials and click “Save and continue”:
   • Feishu: App ID and App Secret
   • WeCom: Corp ID, AgentId, and Secret
   • CAS: Client ID and Client Secret. The “CAS server” is configured by the deployment, and organization admins can’t change it; if the deployment hasn’t configured a CAS server, CAS sign-in isn’t available.
4. Click “Test connection” to check the credentials.
5. Click “Verify login”, enter your current account password, and complete a sign-in yourself.

Once verification passes, the status changes to “Verified and enabled”, and only then does the matching sign-in button appear on the organization sign-in page.

Rules and limits

• An organization can have only one enterprise sign-in method enabled at a time. To switch to another, first “Disable” the current one.
• “Email and password” is always on, so members can always sign in to the organization with email and password.
• After you “Disable” a method, its configuration and members’ linked accounts are kept; members just can’t sign in that way for now.
• Before you disable or delete a method, if some members rely only on it to sign in, the page warns that “N members need another login method”, and you can click “Notify members to set a password”. At least one Owner must keep another working sign-in method.

Can new members join directly through SSO?

WeCom and CAS each have a switch that decides whether people who haven’t joined the organization yet can join directly through SSO:

Switch	When on	When off
Provision accounts from WeCom	Anyone within the app’s visibility scope joins this organization as a “Member” the first time they sign in	People who haven’t joined this organization need an admin invite
Provision accounts from CAS	A CAS account joins this organization as a “Member” the first time it signs in	People who haven’t joined this organization need an admin invite

People who were removed from the organization still need to be re-invited, even with the switch on.

CAS also has “Trusted email domains”: when CAS returns an email in one of these domains and no matching account exists yet, the account is created on first sign-in without sending a verification code. Matching is exact and doesn’t include subdomains, with up to 20 domains. “Skip verification for every email domain” applies to any domain; turn it on only if employees can’t change their own CAS email.

Restrict who can join through invite links

This setting has nothing to do with SSO and is available to any organization. Owners or admins go to “Invite link email verification” in “Settings → Organization → General”:

1. Turn on “Verify email domain for invite links”.
2. Under “Allowed email domains”, add domains such as @example.com. Subdomains must be added separately.
3. Click “Save invite policy”.

Once this is on, only verified emails in an allowed domain can join through an invite link. Invites sent to a specific email address aren’t affected, and removing a domain doesn’t remove members who have already joined.

Manage your own sign-in

In “Settings → Account”, you can:

• See your available sign-in methods under “Login methods”, and connect or “Unlink” Google. You can’t remove your last sign-in method; if you don’t have a password, set one first.
• “Change password”, optionally signing out of your other sessions at the same time.
• See the devices you’ve signed in on under “Sessions”, and “Sign out this session” or “Sign out everywhere”.

Related pages

• Organization: inviting members and roles
• Permissions: what each role can do
• Security