Skip to main content
EigenPal supports password login and SSO for single-tenant installations. Keep authentication enabled. Use the administrator configured during installation to set up access.

​
Connect OIDC

Supply these variables to the app, with the client secret in a Kubernetes Secret:
Register https://<your-host>/api/auth/callback/company at your identity provider. Keep the provider ID stable. By default, OIDC admits unmatched users as members. Set an explicit mapping and deny fallback to limit admission:
Test an allowed user and an unmapped user before switching to SSO-only login.

​
Grant resource access

SSO manages identity and directory membership. In Studio, grant groups access to top-level workflow folders or standalone workflows. A person’s organization role caps those grants. Local EigenPal groups also work with SSO. Administrators manage their memberships; directory memberships refresh from the identity provider. Groups with the same name remain distinct. Set roles and grants separately in each environment, for example editing in development and viewing in production. Promotion preserves local policy. New imported top-level resources start private. Use service accounts and per-environment API keys for integrations.

​
Additional settings

EIGENPAL_AUTH_METHODS accepts password and sso, comma-separated. Password is enabled by default. Leave EIGENPAL_ALLOW_OPEN_SIGNUP=false for invitation-only signup.If you pin tenant.id, use tenant_[a-z0-9_]{1,56} and preserve it after initialization. Keep BETTER_AUTH_SECRET stable and at least 32 characters long.
SSO_SCOPES defaults to openid,profile,email. SSO_GROUP_FILTER limits mirrored groups. An explicit role map can assign admin, member, reviewer or viewer. The fallback allows member, reviewer, viewer or deny. SSO cannot assign owner.
SSO_PROTOCOL=user-auth supports compatible redirect/token-exchange services using SSO_LOGIN_URL, SSO_SERVICE_URL, SSO_APP_ID and an application secret or mTLS credentials. Its default fallback role is deny.Mount certificates before setting SSO_CLIENT_CERT_FILE, SSO_CLIENT_KEY_FILE or SSO_CA_BUNDLE_FILE. User-info and lookup paths resolve against the service URL.A compatible user-lookup endpoint enables directory refresh. Set maximum staleness at least as high as the refresh interval. Arbitrary OIDC providers do not necessarily support this lookup protocol; see SSO fields.