SSO
Sentinel supports signing in to the admin interface via OpenID Connect (OIDC) or LDAP/Active Directory, instead of (or alongside) local passwords.
OpenID Connect (OIDC)
Four providers are supported, each configured as a single URL-encoded environment variable with clientId/clientSecret from that provider's admin console:
| Provider | Variable |
|---|---|
| Microsoft Azure | SSO_AZURE=?clientId={clientId}&clientSecret={clientSecret}&tenantId={tenantId} |
| Google Workspace | SSO_GOOGLE=?clientId={clientId}&clientSecret={clientSecret} |
| Keycloak | SSO_KEYCLOAK=https://your-keycloak-domain:8080/?realm={realm}&clientId={clientId}&clientSecret={clientSecret} |
| Okta | SSO_OKTA=https://{your-account}.okta.com/?clientId={clientId}&clientSecret={clientSecret} |
Register the matching OAuth callback URL with your provider, following the pattern /v1/oauth/<provider>/callback (e.g. https://sentinel.example.com/v1/oauth/azure/callback).
LDAP / Active Directory
SSO_LDAP=ldap://your-ldap-server:389?userDn=dc=your-domain,dc=comSSO_LDAP is a single URL with the LDAP server address plus query parameters:
| Parameter | Purpose |
|---|---|
userDn | User DN template. Supports the USERNAME placeholder, substituted with the entered username at login. |
adminDn | DN of the LDAP administrator account used to bind and search. Optional. |
adminPassword | Password for adminDn — required if adminDn is set. |
userSearchBase | Base DN to search for users. Required if adminDn is configured. |
usernameAttribute | Attribute matched against the entered username in equality searches. Default uid. |
username | Overrides the user-provided username before lookup. Also supports the USERNAME placeholder. |
name | Display name for this SSO method, shown on the login screen. |
starttls | Enable StartTLS — only with ldap:// URLs, not ldaps://. |
rejectUnauthorized | Whether the server's TLS certificate must validate. |
groupsSearchBase | Base DN to search for the authenticated user's groups. |
groupClass | objectClass value used in the group search filter. |
groupMemberAttribute | Group attribute representing membership (e.g. member). Default member. |
groupMemberUserAttribute | User attribute checked against group membership (e.g. dn). Default dn. |
TLS certificate material for the LDAP connection: SSO_LDAP_TLS_CA, SSO_LDAP_TLS_CERT, SSO_LDAP_TLS_KEY.
Disabling password login
Once SSO is configured and working, set PASSWORD_LOGIN_ENABLED=0 to require it for all admin sign-ins.
Related
- Users & Accounts — roles and per-account access still apply to SSO-provisioned users.
- ENV Variables — variable reference.