Single sign-on
You are already using single sign-on. There is no separate Cockpit password and no Cockpit login form. Opening the Cockpit hands you to Revenexx SSO, the revenexx identity provider, and it hands you back with a session.
What that means in practice
One account, one sign-in. The identity provider issues your session for the Cockpit and for the other revenexx services you have access to. Sign out in one place and the session is gone.
Your password lives with the identity provider. You set it when you accept your invitation and change it under Settings › Profile › Security. Nobody at your company and nobody at revenexx can read it.
Access is granted by being a member. Somebody who has not been invited to your organisation cannot sign in, no matter that they have a valid revenexx account. Invitations are handled in Settings › Team; see Users, roles and permissions.
Add a second factor. Single sign-on concentrates access in one credential, which is exactly why that credential should not be a password alone. Enrol a passkey or an authenticator app; see Security and data protection.
When sign-in fails
The failure page says Sign-in failed. We couldn't establish a session with Revenexx SSO. In practice it is one of three things, in the order worth checking:
| Symptom | Usual cause | Fix |
|---|---|---|
| A colleague who has never signed in gets the failure page | The account is not provisioned for the Cockpit | Check they appear under Settings › Team; re-invite if not |
| Someone who signed in yesterday gets it today | The session was rejected, usually a stale or partial browser session | Sign out fully, clear the site's cookies, try again in a private window |
| Everyone gets it at once | An identity-provider problem | Do not re-invite anybody. Raise it with support |
The one thing not to do is create a second account for the same person. You end up with duplicate members, split activity, and a suspended account that is not the one being used.
Connecting your own directory
Mittelstand companies usually run Active Directory or Microsoft Entra ID and would prefer their team not to have another identity at all. Federating your directory with Revenexx SSO is possible: the identity provider speaks SAML and OIDC, and a federated sign-in means your colleagues authenticate with your directory and arrive in the Cockpit without a second password.
What to check
Ask a colleague to sign in from a device they have never used. They should reach the Cockpit without you doing anything. If they hit the failure page, the account is not provisioned. Start at Settings › Team.