Single sign-on
Let people sign in with your identity provider (OIDC) or directory (LDAP, Active Directory), with roles and teams coming from directory groups.
With single sign-on, nobody has to be invited. Someone gets access the way your organisation already grants it, by joining a directory group, and then opens 3AM and is in. Your MFA and access rules apply, and 3AM never sees a password. Every tier includes it.
Set it up under Settings → How people sign in, or in the first step of setup.
With an identity provider (OIDC)
Entra ID, Okta, Ping, Keycloak and ADFS all work.
Register 3AM with your provider
Create an application (a web app or confidential client) with this redirect address:
https://<your 3AM console address>/v1/auth/sso/callbackNote the issuer URL, client ID and client secret it gives you.
Enter them in 3AM
In Settings → How people sign in, choose Identity provider, and paste the issuer, client ID and secret. The
console also shows the redirect address to register. Group claims are usually called groups; Entra ID sends group
IDs rather than names.
Map groups to roles
Give each directory group a role, and optionally teams. Someone in several groups gets the highest role, and every team. Someone in no mapped group gets no access.
The console address must be one people's browsers reach: set it with --console-url on a server, or consoleUrl on
Kubernetes.
With a directory (LDAP or Active Directory)
For sites where no identity provider is reachable. People sign in with their directory password, which 3AM checks against the directory over TLS and never stores.
Give 3AM the directory's address and a read-only service account. A server name is usually enough: 3AM works out the kind of directory, where people and groups are, and how membership is stored, including nested groups. If the directory's certificate isn't one the server trusts, Connect shows it, and you can trust exactly that certificate. For an unusual directory, Show what 3AM worked out lets you override any of it.
Staying in step
3AM re-reads the mapped groups every 15 minutes (Sync now does it at once).
- Someone who leaves every mapped group is suspended, and their sessions end.
- People appear in 3AM before they first sign in, so they can be asked to approve fixes from day one.
- If the directory can't be reached, nobody changes. An outage never locks people out.
With an identity provider and no directory account, sessions last at most 8 hours, so people pass through the provider again.
People added by hand
By default, people added by hand (a contractor, a pilot user) can still sign in with emailed codes alongside directory users. Turn this off to let only the directory in; a mapped group must then give the owner role. The admin token stays as audited break-glass either way.
Roles and teams of directory users follow their groups, and can't be edited on the Team page. The last owner is never demoted by a group change.
Common questions
With a Keychain, single sign-on set up on the home reaches every member. Each install still needs its own redirect address registered with your provider.
Yes. Test tries the settings, and people added by hand keep signing in with codes until you turn that off.
API
| Call | What it does |
|---|---|
GET /v1/auth/sso/start, GET /v1/auth/sso/callback | The trip to the identity provider and back |
POST /v1/auth/ldap {username, password} | Sign in with a directory password |
GET, PUT /v1/settings/sso | The settings (admin; secrets are write-only) |
GET /v1/settings/sso/groups?q= | Find directory groups by name (admin) |
POST /v1/settings/sso/discover, /test, /sync | Try an address, test the saved settings, sync now (admin) |