Skip to main content

Enterprise Identity

Enterprise identity connects a company identity provider to one Moltern organization. Keep at least one verified local owner available while changing sign-in policy.

Availability​

Enterprise identity controls are plan- and organization-dependent. Open Organization -> Security -> Identity to see whether they are enabled.

OpenID Connect sign-in and SCIM directory provisioning are supported. SAML metadata can be recorded for rollout planning, but SAML sign-in is not currently active.

Verify A Domain​

  1. Select Domain in the Identity tab.
  2. Enter a domain your organization controls.
  3. Add the displayed verification record at your DNS provider.
  4. Return to Moltern and select Verify.

Verification proves control of the domain before it can affect sign-in discovery or invitation policy.

Add An OpenID Connect Provider​

Prepare the issuer URL, client ID, client secret, and provider redirect configuration.

  1. Select Identity provider.
  2. Choose OpenID Connect.
  3. Enter a clear connection name.
  4. Enter the public HTTPS issuer URL and client credentials.
  5. Review and confirm the protected change.
  6. Run Check.
  7. Activate the connection only after health succeeds.

The secret is stored securely and is never returned in provider lists or audit exports. Moltern rejects private, loopback, or otherwise unsafe metadata endpoints.

Sign-In Discovery​

After a verified domain and healthy active connection are configured, a user can enter their company email during enterprise sign-in discovery. Moltern selects only the matching organization's active provider.

Existing local login methods remain important for recovery until the organization has tested its enforcement policy.

Configure SCIM​

SCIM synchronizes organization users and groups. It does not silently create workload access grants.

  1. Create a directory token in the Identity tab.
  2. Store the token when it is shown once.
  3. Configure the provider with the Moltern SCIM base URL shown by your account team.
  4. Test user creation, suspension, and removal.
  5. Test group creation and membership changes.
  6. Grant synchronized groups access separately from Organization -> Access.

Revoke the directory token during rotation or provider retirement. Deprovisioning suspends or removes directory membership and invalidates inherited access without granting unrelated authority.

SAML Status​

The UI accepts a public metadata URL as a disabled configuration record so teams can review and plan migration. Health and activation intentionally remain unavailable until the complete SAML assertion and callback flow is released.

Troubleshooting​

SymptomWhat to check
Domain remains pendingConfirm the exact DNS name and value, then allow for propagation.
Provider health failsCheck issuer discovery, HTTPS trust, client registration, and redirect URL.
User is provisioned but sees no workspaceAssign an explicit direct or group role grant.
SCIM token no longer worksCheck expiry or revocation and issue a replacement credential.
SAML cannot be activatedSAML sign-in is not live; use OpenID Connect for current federation.

Next: Review active access and protected actions.