SSO with OIDC & SAML, SCIM Provisioning

Single sign-on, SCIM provisioning and revoking accessSign in with the identity provider you already run, let your directory decide who exists and what they may do, and stop a person in seconds rather than when their token runs out. On a server installation every person signs in, and who they are decides everything that follows: their role, the projects and connections they may open, the rows and columns a data-access policy lets them see, and the name on every audit record. ATX AnalyticsTable signs people in through Microsoft Entra ID, through any OpenID Connect provider — Okta, Auth0, Keycloak, Ping, OneLogin, Google — or through any SAML 2.0 identity provider such as ADFS or Shibboleth, and several can be offered side by side. The identity provider's groups and roles feed one role map, so Viewer, Analyst and Admin mean the same whichever way a person arrived. A sign-in token is a photograph taken when it was issued, so on its own a removed role would keep working until the token expired. Three controls close that gap: SCIM 2.0 provisioning lets your directory decide roles and groups on every request; a maximum token age makes the app fetch a fresh token, with the current roles, every few minutes; and an administrator can revoke a person — or everyone — at once. The desktop app is unaffected: nobody signs in there, and the person at the keyboard is the administrator of their own installation.

What it does

Microsoft Entra ID, OpenID Connect and SAML 2.0 sign-in on one server, with one button per provider on the sign-in screen
OpenID Connect by discovery: enter the issuer, client id and secret, test discovery, save — Authorization Code with PKCE, state and nonce; bearer tokens from the same issuer accepted for scripts and other apps
SAML 2.0 as a service provider: import the published SP metadata into the identity provider, paste its signing certificate, and the assertion must be signed, must answer a request this server sent and is accepted once
Roles and groups from the provider's claims or attributes mapped to Viewer, Analyst and Admin — the built-in AT.Admin, AT.Analyst and AT.Viewer names work with no configuration
Server-side sessions after an OIDC or SAML sign-in: an absolute lifetime, an idle timeout, roles refreshed from the provider every five minutes, and a sign-out that ends the session on the server
SCIM 2.0 provisioning at /scim/v2 for users and groups, with its own bearer token, accepting both Entra ID's and Okta's request styles
An authoritative directory: a person missing from it or deactivated is refused, and their roles and groups come from the directory on every request
Revoke a person from Settings: every session ends and every token issued before that moment is refused; optionally block them until an administrator lifts it
A maximum token age that makes the app renew Entra and OIDC tokens silently, so a role removed in Entra disappears within minutes
Every sign-in, sign-out, provisioning change, revocation and session end written to the tamper-evident audit trail

How it works

Choose the method from what you run. Entra ID alone: Entra sign-in, with a maximum token age of a few minutes. Entra ID with provisioning, Okta or OneLogin: their sign-in plus SCIM, so a change in the directory applies to the next request. A SAML-only provider such as ADFS: SAML sign-in, plus SCIM where it is available. Several providers can be switched on together.
An OpenID Connect provider is connected in Settings → Identity (Entra ID) → OpenID Connect. Register a web application at the provider with the redirect URI the screen shows (https://<server>/sso/oidc/callback), enter the issuer exactly as the provider publishes it, the client id and secret, and the claims that carry roles and groups — Keycloak keeps them at realm_access.roles, for example. Test discovery confirms the provider answers; the client secret goes to the server's credential vault and is never shown again.
A SAML provider is connected in the same screen. Import https://<server>/sso/saml/metadata into the identity provider, or enter the ACS URL https://<server>/sso/saml/acs by hand; have it sign the assertion and send a groups attribute. Then paste the IdP sign-in URL, its entity ID and its signing certificate — more than one during a certificate rollover.
Signing in, the person clicks their provider's button and signs in there with whatever the provider demands: a password, MFA, a smart card. The server checks what comes back — signature, issuer, audience, time, and that it answers the sign-in this browser started — and creates a session. The browser receives a one-time code that only works in the browser that began the sign-in, so a link carrying somebody else's sign-in is useless.
Groups and roles from the provider are matched against the role map; the highest matching role wins and anyone matching nothing gets the default role. Group names, Entra group object ids and app-role values can all be mapped, and the same principals drive object-level access and data-access policies.
SCIM is switched on in Settings → Identity (Entra ID) → SCIM provisioning: Generate token, copy it once, and give the identity provider the tenant URL https://<server>/scim/v2 and the token. From then on the directory is authoritative. Someone removed from a group loses what it gave them on their next click; someone deactivated is refused, their sessions end and their earlier tokens are revoked. Entra provisions every 40 minutes or so — Provision on demand applies a change at once — while Okta pushes changes within seconds.
To stop a person now, an administrator enters their user name or e-mail under Revoke access and clicks Revoke now. The app of someone whose Entra token was revoked silently fetches a new one, which carries the roles they hold today; someone signed in through OIDC or SAML sees the sign-in screen. Block until unblocked keeps a leaver out even if they sign in again. Active sessions lists every live single sign-on session, and each can be ended on its own.
Without SCIM, ANALYTICS_AUTH_MAX_TOKEN_AGE_SECONDS=300 bounds how long a removed Entra role can survive: any token older than five minutes is refused with token_stale, the app renews it silently and repeats the request.

Practices that keep it reliable

Provision with SCIM wherever your identity provider supports it — it is the only control under which a change in the directory applies to the very next request
Without SCIM, set a maximum token age of about five minutes; it costs one silent token request per person every five minutes
Map existing groups to the three roles rather than inventing app roles nobody maintains — and give viewers a database login that is read-only in the database itself
For a leaver, disable the account at the identity provider first, then Revoke now with Block until unblocked
Set ANALYTICS_PUBLIC_URL to the address people open when the server sits behind a reverse proxy, so the redirect URI and the SAML ACS URL are the ones you registered
Point an identity provider's portal tile at /sso/saml/login: an unsolicited SAML response is refused by design
Keep the SCIM token as you would a service password — it can change the directory, though it opens nothing else

In a regulated environment

No password for the application exists or is stored: authentication, MFA and conditional access stay with the identity provider your security team already runs and audits.
Access follows the directory. With SCIM, joiners, movers and leavers are handled where they already are — in Entra ID, Okta or the IdP of your choice — and the application refuses anyone the directory has deactivated.
Session tokens and SCIM tokens are stored as SHA-256 digests only; the OIDC client secret lives in the credential vault and no endpoint returns it.
The audit trail records auth.signin with the provider used, auth.signout, every scim.user and scim.group change, identity.revoke, identity.unblock and identity.session.end — evidence for a periodic access review.
Stated plainly: sessions and the directory are files on the server that issued them, so a multi-replica deployment needs sticky sessions; SAML Single Logout and encrypted assertions are not supported.

Screens

Sign-in required — one button per identity provider the server offers, here an OpenID Connect provider and a SAML identity provider side by side.
Settings → Identity (Entra ID) — OpenID Connect by issuer, client and claims; SAML by IdP sign-in URL, entity ID and signing certificate. The redirect URI and SP metadata URL to register are shown, not guessed.
SCIM provisioning with the directory it holds, Revoke access for one person, and every live single sign-on session — each one can be ended on its own.

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.