OIDC / SSO overview¶

Federated sign-in is configured per identity provider on the Identity Providers page in your dashboard, alongside local accounts - not instead of them. This page covers the concepts that apply to any provider; for a concrete walkthrough see Microsoft Entra ID setup.

Provider types¶

A provider's shape is fixed permanently at creation:

Tenant-wide - no fixed organization. Its mapped roles may grant an all-organizations role, tenant administration, or a specific organization's role. Users enter via its direct /auth/oidc/<slug>/start link or via the shared login page's email-domain discovery.
Organization - bound to exactly one organization. Every user who signs in through it lands in that organization and only that one, regardless of what their token asserts. Never named on the shared login page.
Platform-wide - only visible to platform administrators, only on a platform-mode deployment. Maps to the Platform roles below.

The core invariant

Which tenant / organization a federated user belongs to is decided by which provider connection authenticated them, never by a claim inside their own token. A compromised identity provider can assert anything about a user; it can never talk its way outside the connection it came through.

Role mapping is default-deny¶

Each provider has a role claim (default roles) and a table of role mappings, each pairing one value your provider asserts to one CertIntel role. A login whose claim values match none of the mappings - and has no fallback role - is refused, and nothing is provisioned. Role assignment is fully resynced on every login: removing someone from a mapped group in your IdP removes the corresponding CertIntel role at their next sign-in.

The `CertIntel.*` claim convention¶

Beyond the explicit mapping table, these claim values are recognised automatically. This is the current namespace - rename a value in your IdP and its use here together; the former namespace is rejected, not aliased.

Claim value	Grants
`CertIntel.TenantWide.Administrator`	Administrator across all orgs + tenant administration
`CertIntel.TenantWide.Operator` / `.Observer` / `.Viewer`	that role across all organizations
`CertIntel.AllOrgs.{Administrator\\|Operator\\|Observer\\|Viewer}`	that role across all organizations, without tenant administration
`CertIntel.Org.<org-id-or-slug>.{Administrator\\|Operator\\|Observer\\|Viewer}`	that role in the named existing organization only
`CertIntel.PlatformWide.{Administrator\\|Operator\\|Observer}`	the matching Platform role - platform-wide provider only

The Identity Providers page pre-fills the default mapping rows for the tenant tiers when you create a provider. Platform tiers and the platform-wide provider type are shown only to platform administrators.

Disabling a federated user doesn't depend on your IdP¶

The disabled flag on a user account is deliberately never resynced from the provider. It is the one lever an administrator has to immediately cut off a federated account from the Users page without directory-admin access to that organization's identity provider.

Single logout¶

Signing out ends the local session, then - for a federated session - redirects the browser through the provider's own end-session endpoint (RP-initiated logout). This is a hard requirement: a provider whose discovery document has no end_session_endpoint is refused at configuration time, not silently degraded. Back-channel and front-channel logout URLs are shown on the Identity Providers page once you create a provider; use whichever your provider supports.

What you'll need, for any provider¶

Discovery URL (https://.../.well-known/openid-configuration) and the Issuer it reports - both must be https:// and must match exactly.
Client ID and Client secret - the secret is encrypted at rest (not hashed; it is replayed to the provider at every sign-in).
Role claim and role mappings.