Single sign-on (SAML / OIDC)

DXDT supports per-tenant SSO with any SAML 2.0 or OIDC identity provider — Okta, Azure AD / Entra ID, Google Workspace, and others.

Availability

SSO is an Enterprise tier feature. Configuration requires a tenant admin account.

How sign-in works

Users go to <host>/login/sso, enter their work email, and DXDT resolves the email domain to your tenant and redirects to your IdP. IdP-initiated SAML sign-in is also supported. On return, DXDT:

• re-checks the tier gate,
• enforces your allowed email domains,
• provisions the user just-in-time (seat-gated — sign-in fails cleanly if your seat limit is reached, rather than silently adding seats).

Configure

Settings → Single sign-on (tenant admin), or via API: GET/PUT/DELETE /api/tenant/sso. Secrets are always masked on read.

SAML 2.0 (Okta, Azure AD, etc.)

DXDT's service-provider identity for your tenant:

	URL
Entity ID / Audience	https://<your-dxdt-host>/auth/saml/metadata/<tenant_id>
ACS (Reply) URL	https://<your-dxdt-host>/auth/saml/acs/<tenant_id> (HTTP-POST)
SP metadata XML	download from the Entity ID URL and upload to your IdP

Then enter in DXDT (from your IdP's app config):

Field	What it is
idp_entity_id	IdP issuer / entity ID
idp_sso_url	IdP sign-on URL (must be https://)
idp_x509_cert	IdP signing certificate (paste the PEM; headers are normalised automatically)
allowed_domains	Email domains allowed to sign in via this IdP

Okta: Applications → Create App Integration → SAML 2.0 → set Single sign on URL = ACS URL, Audience URI = Entity ID; map email as the NameID / email attribute.

Azure AD / Entra ID: Enterprise applications → New application → Create your own → set Identifier = Entity ID, Reply URL = ACS URL. Default Azure claim mappings (emailaddress, name/UPN, displayname, givenname) are recognised out of the box.

OIDC

Field	What it is
issuer	Your IdP's issuer URL (https://) — discovery is used from here
client_id / client_secret	From the app registration in your IdP
allowed_domains	Email domains allowed to sign in

Redirect URI to register in your IdP: https://<your-dxdt-host>/auth/oidc/callback

Notes

• IdP secrets (client_secret) are stored encrypted at rest and never returned by the API after write.
• SSO co-exists with Google/Microsoft social sign-in; enforcing SSO-only sign-in for your domain is available on request.
• CLI/API access is unaffected: dxdt login rides the same browser session, so SSO users mint tokens the same way — see Authentication.