Set up single sign-on

Single sign-on (SSO) lets members of your Leebry organization sign in through your identity provider (IdP) instead of using Leebry user name and password. Once SSO is configured, users with email addresses on a verified domain can authenticate through the IdP and return to Leebry after successful sign-in.

Before setting up SSO, make sure that:

• You use the following redirect URI for Leebry in your IdP:

  https://sso.leebry.ai/api/oauth/oidc

• The email domain used by your organization is verified in Leebry.

SSO setup consists of the following steps:

1. Create an OpenID Connect (OIDC) web application, add the Leebry redirect URI, and get the required information: Discovery URL, Client ID, and Client Secret.

2. Connect your SSO provider in Leebry.

3. Test the SSO sign-in flow and confirm that it works as expected.

Leebry uses the standard OIDC sign-in flow and requires the openid scope. No additional scopes, such as email or profile, are required by Leebry unless they're required by your organization's policies or IdP configuration.

Create a confidential OIDC web client in your IdP, such as Okta, Google Workspace, Microsoft Entra ID, or another provider. You'll need the following values when connecting the IdP to Leebry:

• Discovery URL — the OIDC metadata URL, usually ending in /.well-known/openid-configuration
• Client ID — the identifier assigned to the OIDC application
• Client Secret — the secret generated for the OIDC application

Okta

1. Sign in to the Okta Admin Console.

2. Go to Applications > Applications.

3. Click Create App Integration.

4. Select "OIDC — OpenID Connect" as the sign-in method and "Web Application" as the application type.

5. Add the following sign-in redirect URI:

   https://sso.leebry.ai/api/oauth/oidc

6. Save the app.

7. Copy the Client ID and Client Secret.

8. Assign the users or groups who should be able to use SSO to the app.

For Okta, use one of the following Discovery URLs depending on the authorization server:

Replace {yourOktaDomain} and {authorizationServerId} with the corresponding values from your Okta organization. Okta documents these as the OIDC discovery endpoints for its organization and custom authorization servers.

Google Workspace

1. Open the Google Cloud Console and select or create a project.

2. Configure the OAuth consent screen.

3. Create an OAuth client ID for a web application.

4. Configure the authorized domains required by your Google Cloud project.

5. Add the following authorized redirect URI:

   https://sso.leebry.ai/api/oauth/oidc

6. Create the client and copy the Client ID and Client Secret.

Google provides the following Discovery URL:

https://accounts.google.com/.well-known/openid-configuration

Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.

2. Go to Entra ID > App registrations > New registration.

3. Register the application and add the following redirect URI:

   https://sso.leebry.ai/api/oauth/oidc

4. Copy the Application (client) ID and Directory (tenant) ID.

5. Create a client secret and copy its value immediately.

Use the following Discovery URL, replacing {tenantId} with your tenant ID or verified tenant domain:

https://login.microsoftonline.com/{tenantId}/v2.0/.well-known/openid-configuration

Microsoft documents /.well-known/openid-configuration as the OpenID Connect metadata endpoint appended to the tenant-specific authority URL.

Other providers

1. Create a confidential OIDC web client that uses the Authorization Code flow.

2. Set the redirect URI to

   https://sso.leebry.ai/api/oauth/oidc

3. Generate a Client ID and Client Secret.

4. Find the issuer's Discovery URL (OIDC metadata URL), which typically ends with /.well-known/openid-configuration.

1. Sign in to Leebry as an organization admin.

2. In the bottom-left corner, click your user name, then choose SSO Settings.

   

3. On the Single Sign-On tab, click Add SSO Provider.

4. Select your IdP: Okta, Google Workspace, Microsoft Entra ID, or Other.

5. Enter the required information, then click Connect.

6. After the connection becomes active, click Done.

   Leebry confirms that SSO has been connected.

   

Required fields

After connecting the IdP, test the SSO flow from sign-in to authentication.

1. Sign out of Leebry or open a private or incognito browser window.

2. Go to the Leebry sign-in page.

3. Enter a work email address that uses your verified domain, such as [email protected].

4. Click "Sign in with SSO".

5. Authenticate through your IdP.

6. Confirm that you're redirected back to Leebry and signed in successfully.

During the first SSO sign-in, an existing Leebry account that uses password-based authentication may ask you to confirm the password once to link the account to the SSO identity.