Single sign-on setup (OIDC)

Configure single sign-on (SSO) so your team signs in through your company identity provider instead of a LambdaAssetCheck password. LambdaAssetCheck uses OpenID Connect (OIDC) and connects to your own identity provider (bring your own IdP).

Who can do this: owners and admins. Where: Administration → Organization Settings → Security (SSO).

Supported identity providers:

- Google Workspace - Microsoft Entra ID (Azure AD) - Okta - Oracle IAM - Any custom OIDC provider

What you'll need

Before you start:

- Organization admin access (owner or admin role) - Professional plan or higher — SSO is a licensed feature on the Professional tier - An OIDC application in your identity provider (IdP) - At least one invited user in LambdaAssetCheck whose email matches your company domain (SSO does not auto-create accounts)

The sign-in redirect URI you'll enter in your IdP is your app URL followed by /api/auth/sso/callback — for example https://app.lambdaassetcheck.com/api/auth/sso/callback. The exact value for your environment is shown in the SSO settings wizard.

How SSO works (short)

1. An employee enters their work email on the sign-in page. 2. LambdaAssetCheck looks up the email domain and shows Continue with {Organization} SSO if SSO is enabled. 3. The user signs in at your IdP. 4. LambdaAssetCheck verifies the email belongs to an existing, active user in your organization (invite-only). 5. The user receives a normal app session (same as password login).

Important: Users must be invited first. SSO links their IdP account on first successful login; it does not provision new users automatically.

Step 1 — Confirm your plan

1. Sign in as an organization admin. 2. Go to Administration → Organization settings → Security (SSO) (/admin/settings/organization?tab=security) 3. If you see an upgrade message, your organization needs the Professional plan before SSO can be configured.

Step 2 — Create an OIDC app in your IdP

In your identity provider, create a confidential OAuth / OIDC web client with:

Examples:

Copy the Client ID and Client Secret from your IdP — you will paste them into LambdaAssetCheck in Step 4.

The exact redirect URI is also shown on the Security (SSO) tab in the app (use Copy redirect URI).

Step 3 — Open the SSO settings wizard

1. Go to Administration → Organization settings. 2. Open the Security (SSO) tab. 3. Choose your Identity provider preset: - Google Workspace - Microsoft Entra ID (Azure AD) - Okta - Oracle IAM - Custom OIDC

The wizard shows IdP-specific checklist steps below the preset selector.

Step 4 — Enter connection details

Fill in the fields on the Security tab:

Issuer URL by provider

For Azure Entra and Okta, you can enter the tenant ID or Okta domain in the helper field and the issuer URL is built for you.

Email domain rules

- Domains are matched when users sign in (e.g. jane@acme.com → domain acme.com). - Each domain can only be claimed by one organization in LambdaAssetCheck. - Add every domain your employees use for work email.

Click Save to store the configuration (you can save before enabling SSO).

Step 5 — Invite users (required)

Before SSO works for employees:

1. Go to Administration → Users (or your usual invite flow). 2. Invite each person who should sign in with SSO. 3. Use the same work email address they use at the IdP (e.g. jane@acme.com).

Users who are not invited will see: *"No account found for this email. Contact your administrator."*

Step 6 — Test the connection

1. On the Security (SSO) tab, click Test connection. 2. Settings are saved automatically, then you are redirected to your IdP. 3. Sign in with your own admin account (must be an existing user in the org, with an email on one of the configured domains). 4. After success, you return to organization settings and the status shows Tested.

If the test fails, check:

- Redirect URI in the IdP matches exactly (including https and no trailing slash on the app URL) - Client ID and secret are correct - Issuer URL is correct and reachable - Your signed-in IdP email matches an invited LambdaAssetCheck user in this organization

Step 7 — Enable SSO for employees

1. Turn on Enable SSO (or click Publish SSO after a successful test). 2. Optionally turn on Require SSO for all users: - When enabled, password login is blocked for users in your organization (except platform super admins used for break-glass support). - Users must use Continue with SSO on the sign-in page. 3. Click Save or Publish SSO again if you changed toggles.

Recommended rollout:

1. Enable SSO without “Require SSO” first. 2. Ask a few users to sign in with SSO. 3. Then enable Require SSO when everyone is ready.

Step 8 — Employee sign-in

Invite emails when SSO is enabled

When SSO is enabled and the invited user's email domain is in your SSO domain list:

- They receive an SSO invite email with a link to the sign-in page (no set-password link). - They sign in with Continue with SSO — no need to accept a password invite first.

When SSO is off, or the user's email domain is not on your SSO list, they get the standard set password & activate invite.

Standard flow

1. Go to the app sign-in page (/auth/signin). 2. Enter work email (e.g. jane@acme.com). 3. Click Continue with {Your Organization} SSO. 4. Complete sign-in at the IdP. 5. Land in the app with a normal session.

Optional: bookmark org-specific sign-in

You can link directly to sign-in with your organization pre-selected:

/auth/signin?org={your-organization-id}

The organization ID is your tenant UUID in LambdaAssetCheck (admins can get it from organization settings or support).

Password + SSO together

IdP-specific quick reference

Google Workspace

1. Google Cloud Console → APIs & Services → Credentials. 2. Create credentials → OAuth client ID → Web application. 3. Authorized redirect URIs: paste the LambdaAssetCheck redirect URI. 4. Configure OAuth consent screen for your workspace. 5. Issuer URL: https://accounts.google.com.

Microsoft Entra ID (Azure AD)

1. Azure Portal → Microsoft Entra ID → App registrations → New registration. 2. Platform: Web; redirect URI = LambdaAssetCheck callback URL. 3. Certificates & secrets → New client secret. 4. Issuer URL: https://login.microsoftonline.com/{tenant-id}/v2.0. 5. API permissions: openid, email, profile (Microsoft Graph not required for basic SSO).

Okta

1. Okta Admin → Applications → Create App Integration → OIDC → Web Application. 2. Sign-in redirect URI = LambdaAssetCheck callback URL. 3. Allow Authorization Code (PKCE supported). 4. Issuer URL: typically https://{company}.okta.com/oauth2/default.

Oracle IAM

1. Oracle Identity Cloud Service → Confidential OAuth Client. 2. Add redirect URI; enable Authorization Code. 3. Use the Issuer URL from your Oracle IAM app / OIDC discovery document.

Custom OIDC

1. Create a confidential OIDC client in your IdP. 2. Redirect URI = LambdaAssetCheck callback URL. 3. Scopes: openid email profile. 4. Issuer URL must expose /.well-known/openid-configuration.

Troubleshooting

Redirect URI checklist

- Must be exactly: {NEXTAUTH_URL}/api/auth/sso/callback - NEXTAUTH_URL must match the URL users use in the browser (no trailing slash on the env var is fine) - IdP redirect URI must match character for character

Security notes

- Client secrets are encrypted at rest in the database. - SSO login uses a short-lived, one-time token to create the same JWT session as password login. - IdP accounts are linked per organization (oidc:{organizationId}) so tenants stay isolated. - Only active, invited users in the matching organization can complete SSO.

Related documentation

- Organization settings — general organization settings - Roles and permissions — admin access requirements

Admin checklist (summary)

1. ☐ Organization on Professional plan (or higher) 2. ☐ OIDC app created in IdP with correct redirect URI 4. ☐ SSO configured on Security (SSO) tab (preset, issuer, client ID/secret, domains) 5. ☐ Employees invited with matching work emails 6. ☐ Test connection completed successfully 7. ☐ Enable SSO (and optionally Require SSO) 8. ☐ Communicate sign-in URL and Continue with SSO flow to users