Platform · 22 / 23
Sign-in and SSO
Accounts exist by invitation, sessions can be revoked one by one, and OpenID Connect, GitHub and SAML can replace the password.
Accounts are created by invitation — ask an administrator to send you one.
Devices currently signed in as this member.
Last seen 3 days ago from 203.0.113.24. That device will be signed out immediately and must sign in again.
How it works
- 01
An administrator invites someone. Nobody signs themselves up.
- 02
They sign in with a password, or through a configured provider.
- 03
Every signed-in device is listed, and any one can be revoked.
- Providers
- OpenID Connect, GitHub, SAML 2.0
- Passwords
- At least 12 characters
- Sessions
- Listed per member, revocable
In depth · For whoever runs the directory
Your directory signs people in
The identity provider verifies who somebody is; the invite, account status, role and session work exactly as they do with a password.
Invite-only, on both paths
There is no registration form. A provider can sign in an account that already exists and is active, and nothing else. Accounts are linked on the provider’s stable subject, never the email address.
Under the hood
Creating accounts from the directory is off by default. Turning it on requires a list of allowed email domains, so a public provider cannot open the door to everyone.
| Capability | OpenID Connect | GitHub | SAML 2.0 |
|---|---|---|---|
| Callback | Redirect | Redirect | Form POST |
| PKCE | Yes | No | No |
| Replay defence | state + nonce | state | RelayState |
| Verified email | id token claim | /user/emails | operator asserts |
| Group claims for role mapping | Yes | No | Yes |
| Provider sign-out URL | when published | No | No |
| Back-channel logout | Yes | No | No |
| Presets | Google · Entra ID · Okta · Auth0 · Keycloak | github.com · Enterprise Server | No |
What is in the box
Show the table
| Thing | How it works |
|---|---|
| Sessions | Database rows; revoking one is a delete. |
| Passwords | Twelve characters or more, hashed with bcrypt. |
| Adapters | OIDC, GitHub and SAML packages, configured in code. |
| Enforced SSO | Passwords off, except for the root administrator. |
| Role mapping | Your handler maps provider groups to roles. |
| Provisioning | Off by default; needs a domain allow-list. |
When somebody leaves
- Back-channel logout ends it at once
- An OpenID Connect provider that supports it ends the person’s sessions directly, even after the tab is closed.
- Otherwise, the session expires
- Sessions opened through a provider can be given a shorter lifetime than password sessions.
- Disabling here closes both doors
- Status is checked on every request, so a disabled account loses access immediately.
Questions
Do you support Okta, Entra ID, Google Workspace, Keycloak?
Yes, through the one OpenID Connect adapter, with a preset per vendor so you write a tenant id rather than five URLs.
Can the provider decide roles?
Only through a handler you write. Mapped changes are logged, and an administrator is never demoted by it.
What does SAML need?
A persistent NameID or an immutable attribute for the subject; transient or email-address NameIDs are refused.