SSO
Configure per-organization enterprise single sign-on with OIDC so members sign in through your identity provider.
Flax ships with in-house email-and-password authentication and supports per-organization enterprise single sign-on (SSO) over OpenID Connect (OIDC). Configuring SSO is admin-only, under /app/settings/security.
#In-house authentication
By default, members sign in with an email and password managed by Flax. Passwords follow a length policy and sign-in timing is equalized to resist enumeration. See Security. SSO layers on top of this per organization — you do not have to replace built-in auth to use it.
#Configuring OIDC
An admin registers your identity provider by supplying:
| Field | Purpose |
|---|---|
issuerUrl |
Your OIDC provider's issuer URL, used to discover endpoints. |
clientId |
The client ID for the Flax application in your IdP. |
clientSecret |
The client secret. Write-only — leaving it blank keeps the stored value. |
domains |
The email domains routed to this connection. |
enforceSSO |
When enabled, members on these domains must sign in via SSO. |
After saving, use the built-in test action to validate the configuration before enforcing it.
#Domain routing and provisioning
When a user starts sign-in, Flax resolves their email domain to the matching SSO connection and redirects them to your IdP. On the callback it verifies the response and then:
- Reuses an existing linked account, or
- Links a user whose verified email domain belongs to this connection, or
- Just-in-time (JIT) provisions a new SSO-only account (no password).
Important
Enabling enforceSSO for a domain requires those members to sign in through your IdP. Confirm the configuration with the test action first so you don't lock users out.