Enterprise authentication

Open Administration → Connections & identity → Authentication & SCIM to connect CogLake to Microsoft Entra ID, Okta, Google Workspace, Keycloak, or another standards-compliant OpenID Connect provider.

OIDC setup

1. Enable OIDC single sign-on. Provider and credential controls stay hidden until OIDC is enabled.
2. Choose a provider preset and register the displayed callback URL.
3. Enter the issuer URL, client ID, and client secret. After saving, CogLake shows only that a secret is configured.
4. Configure scopes. openid remains required; profile, email, and offline_access are explicit choices.
5. Map email, display-name, and group claims under the advanced settings.
6. Select the default role and optional required identity-provider groups.
7. Run discovery, save, and complete a test login before disabling local login.

MFA policy

The organization-wide control is under Administration → Connections & identity → Authentication & SCIM → Require MFA for every SSO sign-in. The identity provider performs the second factor; CogLake validates its assurance claim before accepting the session. Claim mapping appears only when this policy is enabled.

Personal My settings → Sign-in & security shows whether an identity is provider-managed and links administrators to the organization policy. Local password accounts do not currently have a native CogLake TOTP or WebAuthn enrollment flow; keep local login as a restricted break-glass path when SSO is used.

SCIM and group provisioning

Enable SCIM when your identity provider should create, update, disable, and group users automatically. Token, endpoint, and group-mapping controls remain hidden until provisioning is enabled. SCIM is configured separately from OIDC, so an organization may use provisioning without using the same provider for interactive sign-in.

Safe rollout

• Keep a tested break-glass recovery administrator while changing identity settings.
• Use HTTPS redirect URLs in production.
• Rotate OIDC and SCIM secrets without deleting existing mappings.
• Verify deprovisioning and group removal, not only successful login.