The idea
Institution members sign in with the account they already have (the university's identity provider) instead of creating and remembering a separate Folio password. Administrators can configure either OpenID Connect (OIDC) or SAML 2.0 from the institution console's SSO settings. A first verified sign-in adds the person to the institution's roster as a student automatically, while preserving Folio's duplicate-account safeguards; staff roles are assigned in the console or through SCIM. Folio password sign-in stays available alongside SSO.
Why it matters
For a campus rollout, a second password is a real barrier, to adoption and to IT approval. SSO means no credentials to reset, access that follows someone's university account when they leave, and one fewer thing for a security review to flag. For most institutions this is the difference between "we'll pilot it" and "we'll deploy it."
Where we are
OpenID Connect and SAML 2.0 are both available for institution tenants, set up by the institution's administrator under Protocol.
For SAML, an administrator provides the identity provider's metadata URL, or enters the entity ID, SSO URL, and signing certificate manually, then opens a short verification window and runs a sign-in test. SAML sign-in can only be tested while it is on, so for as long as the window is open, students can use it too; if the test fails, Disable and roll back turns it off again. Folio passes signing material directly to its managed authentication provider and does not retain the certificate in the application database or audit log.
For OIDC, there is no built-in test sign-in: enabling it makes it available immediately. Confirm the identity-provider assignment with your institution's IT team first, and try a sign-in yourself right after enabling it.