Single Sign-On
Sign in to Sentisec with your own identity provider — over SAML or OIDC on hosted plans, or directly against your provider on a self-managed install.
Hosted sign-in uses Clerk enterprise connections. SAML and OIDC availability depends on the provider and connection configuration; contact us to confirm your setup. Self-managed installs have a separate OIDC mode. These paths have different configuration and provisioning needs.
Hosted plans — we broker the connection
On a hosted plan, Sentisec's managed identity layer holds the connection to your provider. You create the application in your own directory; we wire our side to it. In practice:
Ask us to open a connection. Get in touch with your provider and the email domain your people sign in with.
We send you our service-provider details — the ACS URL and entity id for SAML, or the redirect URI for OIDC.
You create the application in your directory using those values, and send back your metadata URL (SAML) or issuer, client id and secret (OIDC).
We enable the connection, scoped to your email domain. From then on, anyone signing in with an address on that domain is sent to your provider to authenticate.
You verify by signing in as a test user and checking they land in the right workspace with the right role.
The vendor pages below cover step 3 — where each console hides the settings, and which attributes to map.
Okta
SAML or OIDC application setup in Okta.
Microsoft Entra ID
Enterprise application setup in Entra, formerly Azure AD.
Google Workspace
Custom SAML app in the Google Admin console.
Zitadel
OIDC application setup in Zitadel.
For an unlisted provider, send its name, protocol and required claims when requesting access. We must confirm the connection and workspace-role mapping before you rely on it for operator access.
Self-managed installs — no broker at all
A Sentisec install you run yourself can authenticate directly against your provider, with no Sentisec-operated service anywhere in the sign-in path. The dashboard runs a standard authorization-code flow with PKCE, the API verifies every token against your provider's own keys, and workspace membership rides on a claim your provider emits.
Self-managed OIDC
The configuration walkthrough, using Keycloak. Other providers must supply compatible tokens and the required workspace-role claims.
Enable the self-managed OIDC mode and configure issuer, audience, signing keys and workspace claims. Workspaces must be provisioned separately; a login does not create a missing workspace. A disconnected installation must host its identity provider and dependencies inside its own boundary. Hosted plans use Clerk instead.
After sign-in
Authentication decides who someone is. What they can then do comes from their role — see Roles and permissions. Directory sync is a separately configured Clerk capability, not an automatic consequence of SSO. Sentisec does not provide its own SCIM endpoint or complete automatic offboarding. Read the provisioning and offboarding boundaries, and explicitly revoke Sentisec API keys when removing access.