Enterprise SSO (OIDC / SAML / LDAP) & Directory Sync
Configuring OpenID Connect, SAML 2.0, and Active Directory LDAP providers with automated 15-minute user provisioning and offboarding.
Identity Federation & Automated Offboarding
Administrators can register OIDC, SAML 2.0, and Active Directory (LDAP) identity providers via POST /api/v1/admin/auth-providers. Provider configurations are encrypted at rest in the database using AES-256-GCM.
A background job runs every 15 minutes (and can be triggered immediately via POST /api/v1/admin/auth-providers/:id/sync) to synchronize directory entries: new employees are provisioned and added to their department channels, while accounts marked disabled in Active Directory are atomically offboarded, their refresh tokens revoked, and a device.wipe command dispatched to their enrolled devices.