# SSO

> **Warning:**
>
> SSO is an **Enterprise**-only feature. See [License](/docs/sentinel/security/license/) and [Pricing](/pricing/).

Sentinel supports signing in to the admin interface via OpenID Connect (OIDC) or LDAP/Active Directory, instead of (or alongside) local passwords.

## OpenID Connect (OIDC)

Four providers are supported, each configured as a single URL-encoded environment variable with `clientId`/`clientSecret` from that provider's admin console:

| Provider | Variable |
|---|---|
| Microsoft Azure | `SSO_AZURE=?clientId={clientId}&clientSecret={clientSecret}&tenantId={tenantId}` |
| Google Workspace | `SSO_GOOGLE=?clientId={clientId}&clientSecret={clientSecret}` |
| Keycloak | `SSO_KEYCLOAK=https://your-keycloak-domain:8080/?realm={realm}&clientId={clientId}&clientSecret={clientSecret}` |
| Okta | `SSO_OKTA=https://{your-account}.okta.com/?clientId={clientId}&clientSecret={clientSecret}` |

Register the matching OAuth callback URL with your provider, following the pattern `/v1/oauth/<provider>/callback` (e.g. `https://sentinel.example.com/v1/oauth/azure/callback`).

## LDAP / Active Directory

```
SSO_LDAP=ldap://your-ldap-server:389?userDn=dc=your-domain,dc=com
```

`SSO_LDAP` is a single URL with the LDAP server address plus query parameters:

| Parameter | Purpose |
|---|---|
| `userDn` | User DN template. Supports the `USERNAME` placeholder, substituted with the entered username at login. |
| `adminDn` | DN of the LDAP administrator account used to bind and search. Optional. |
| `adminPassword` | Password for `adminDn` — required if `adminDn` is set. |
| `userSearchBase` | Base DN to search for users. Required if `adminDn` is configured. |
| `usernameAttribute` | Attribute matched against the entered username in equality searches. Default `uid`. |
| `username` | Overrides the user-provided username before lookup. Also supports the `USERNAME` placeholder. |
| `name` | Display name for this SSO method, shown on the login screen. |
| `starttls` | Enable StartTLS — only with `ldap://` URLs, not `ldaps://`. |
| `rejectUnauthorized` | Whether the server's TLS certificate must validate. |
| `groupsSearchBase` | Base DN to search for the authenticated user's groups. |
| `groupClass` | `objectClass` value used in the group search filter. |
| `groupMemberAttribute` | Group attribute representing membership (e.g. `member`). Default `member`. |
| `groupMemberUserAttribute` | User attribute checked against group membership (e.g. `dn`). Default `dn`. |

TLS certificate material for the LDAP connection: `SSO_LDAP_TLS_CA`, `SSO_LDAP_TLS_CERT`, `SSO_LDAP_TLS_KEY`.

## Disabling password login

Once SSO is configured and working, set `PASSWORD_LOGIN_ENABLED=0` to require it for all admin sign-ins.

> **Warning:**
>
> Confirm SSO sign-in works before disabling password login — locking yourself out requires resetting `PASSWORD_LOGIN_ENABLED` back via the environment, not the admin UI.

## Related

- **[Users & Accounts](/docs/sentinel/configure/users-accounts/)** — roles and per-account access still apply to SSO-provisioned users.
- **[ENV Variables](/docs/sentinel/operations/env-variables/#sso-enterprise)** — variable reference.