Single sign-on (SSO)

Connect LakeSail to an OpenID Connect (OIDC) identity provider so members can sign in with their work credentials. LakeSail supports the provider types shown under Settings → Access, plus Generic OIDC for compatible providers. SAML is not supported.

Adding a provider creates another sign-in option. It does not create members, sync groups, assign roles, or disable password and email sign-in.

Before you begin

You need:

• Permission to manage identity providers in LakeSail and applications in your identity provider.
• A publicly reachable OIDC issuer that supports the authorization code flow and returns an email claim.
• A LakeSail membership for each person who will use SSO. Their primary LakeSail email must match the provider's email claim exactly.

Assign users to the LakeSail application in your identity provider before they try to sign in.

Add a provider

Open Settings → Access, find Identity Providers, and click Configure.

Automatic setup

Automatic setup is available when the provider supports dynamic client registration.

1. Select Automatic Setup (DCR).
2. Enter the provider URL and, if required, an initial access token.
3. Enter the name members will see at sign-in.
4. Click Auto-Configure.

LakeSail discovers the provider and registers the OIDC client. If the provider does not support dynamic registration, use manual setup.

Manual setup

1. Select Manual Configuration.

2. Copy the callback URL shown under Before you start. It uses this format:

   https://<your-lakesail-host>/login/callback

3. Create an OIDC application in your identity provider and add that callback URL as an allowed redirect URI.

4. In LakeSail, enter the issuer URL, client ID, client secret, scopes, and display name.

5. Click Create Provider.

Keep openid in the scopes. The default scopes are openid, email, and profile. A client secret is required for confidential clients and optional for public clients that use PKCE.

Complete the setup

After creating the provider:

1. Open Manage and copy the back-channel logout URL if your provider supports it. Register it in the OIDC application.
2. Test the connection to confirm that LakeSail can discover the provider's OIDC configuration.
3. Assign a test member to the application in your identity provider.
4. In a private browser window, select the organization and click Continue with provider name.

Test a complete sign-in

The connection test checks OIDC discovery. It does not validate the client secret, redirect URI, application assignments, or a complete sign-in. Test with a real member before changing the organization's other sign-in methods.

How member access works

SSO authenticates an existing LakeSail member. It does not create a user, accept an invitation, or add someone to an organization.

Before using SSO, the person must accept their LakeSail invitation. Their primary LakeSail email must then match the email claim from the provider. Manage roles and team membership in LakeSail; provider groups are not imported or mapped.

Require SSO

Configuring a provider does not require members to use it. Allow password sign-in and Allow email sign-in are separate settings under Settings → Access.

Test SSO first, then disable either direct sign-in method that your organization no longer wants to allow. Organization owners retain password access as a recovery path when both direct methods are disabled.

SSO and MFA

When Require 2FA is enabled, an SSO sign-in must show that MFA was completed at the identity provider. LakeSail uses the provider's amr or acr claim when available.

If the provider enforces MFA but does not report it in those claims, open Edit and enable This provider enforces multi-factor authentication. Only enable this when the provider requires MFA for every member who can use the application. LakeSail does not add a local TOTP prompt after SSO.

If neither the token nor the provider setting confirms MFA, LakeSail refuses the SSO sign-in. Removing the provider's MFA setting also revokes sessions that relied on it.

Single logout

The back-channel logout URL uses this format:

https://<your-lakesail-api-host>/api/v1/auth/logout/<organization-id>/<provider-id>

Register it in the identity provider when back-channel logout is supported. This lets the provider notify LakeSail when a member signs out or an identity-provider session is revoked. Without it, signing out of the provider does not immediately end the LakeSail session.

The provider's Manage view shows whether discovery reported back-channel or front-channel logout support.

Rotate a client secret

Create the replacement secret in the identity provider first. Then open the provider's Manage view, choose Rotate Client Secret, enter the replacement, and click Rotate Secret.

LakeSail uses the new secret immediately. Confirm sign-in works, then retire the previous secret in the identity provider. The identity provider determines when the old secret stops working.

A configured client secret can be replaced but not removed. To change from a confidential client to a public PKCE client, delete and recreate the provider.

Delete a provider

Deleting a provider removes its configuration from LakeSail and prevents new sign-ins through it. It does not delete the application in the identity provider or revoke existing LakeSail sessions. Remove the application separately and revoke sessions if your access policy requires it.

Recommended rollout

1. Add the provider and configure its callback URL.
2. Add the back-channel logout URL when supported.
3. Assign a small test group in the identity provider.
4. Confirm sign-in and sign-out with existing LakeSail members.
5. Confirm MFA behavior if Require 2FA is enabled.
6. Assign the remaining members.
7. Disable password or email sign-in only after the SSO flow is verified.

Troubleshooting

Problem	Check
Provider setup cannot discover the issuer	Confirm the issuer URL is public, uses HTTPS, and exposes OIDC discovery metadata.
Redirect URI error	Copy the callback URL from LakeSail exactly, including scheme, host, path, and trailing-slash behavior.
Client authentication fails	Confirm the client ID, client secret, and client authentication method in the provider.
Member is not found	Accept the LakeSail invitation first and make the member's primary email match the provider's email claim.
Member is denied by the provider	Assign the member to the LakeSail application and check the provider's access policy.
MFA is required	Confirm the provider reports MFA in amr or acr, or enable the provider MFA setting after verifying its policy.
Provider sign-out leaves LakeSail open	Configure the back-channel logout URL and confirm the provider supports back-channel logout.

API reference

• Identity Providers: configure, test, update, rotate, and delete OIDC providers.
• Authentication: start and complete federated sign-in.