People can sign in through your organisation's identity service instead of a password: Google Workspace, Microsoft Entra, Keycloak, Okta or any other service that speaks OpenID Connect.
Register mailrust at the service
Create an application of the web type at your identity service. Give it the redirect URI of your installation, character for character:
https://mail.example.com/login/sso/callback
The service gives you a client ID and a client secret.
Set it up in mailrust
Open Admin → Single sign-on and fill in:
| Field | What to enter |
|---|---|
| Sign-in service address (issuer) | What the service calls itself. Google: https://accounts.google.com. Microsoft: https://login.microsoftonline.com/<tenant-id>/v2.0. Keycloak: https://…/realms/<name> |
| Application (client) ID | From the service |
| Client secret | From the service; stored encrypted and never shown again |
| Button label | Goes into Sign in with …. Empty means the service's name |
| Trusted address domains | Domains, separated by commas, whose verified addresses mailrust may match to accounts |
| Create an account on first sign-in | Lets people from those domains sign in the first time without an account made in advance |
Save. mailrust asks the service for its description and saves only if the service answers. The sign-in page then shows the Sign in with … button.
How people are matched
- Linked accounts. A person opens Settings → Security, presses Link and signs in at the service once. From then on the service's account signs them in. They can unlink at any time; the password stays.
- Trusted domains. A person whose verified address is on a trusted domain is recognised by a login equal to that address, without linking.
- New people. With Create an account on first sign-in, a newcomer from a trusted domain gets an account at the first sign-in. Mailboxes are still shared by an administrator.
mailrust matches linked accounts by the service's own account number, not by the email address, and trusts an address only when the service vouches for it.
Removing it
Remove single sign-on takes the button off the sign-in page and erases the links. Passwords and passkeys stay.