DocsEnterprise identity

OIDC SSO and SCIM 2.0

Bring a standards-compliant identity provider. Sendix performs the protocol checks and workspace provisioning without requiring a Sendix-specific identity vendor.

Feature boundary

Identity configuration is workspace-scoped. Owners and admins configure OIDC and create SCIM tokens under Settings → Identity; members sign in through the generated workspace SSO URL.

No paid identity broker required

Sendix talks directly to your OIDC and SCIM-compatible identity system. Your provider may be self-hosted or managed; its own licensing and operation remain outside Sendix.

Configure OIDC

Create a confidential web application in your identity provider, then copy its issuer, client ID, and client secret into Sendix. Register the exact callback URL shown below, replacing the workspace UUID.

https://sendix.dev/api/auth/sso/<workspace-id>/callback

The issuer must publish /.well-known/openid-configuration. Sendix requires Authorization Code flow, requests openid profile email, sends PKCE S256 and a nonce, then verifies signature, issuer, audience, token age, nonce, and verified email.

Domain and provisioning policy

Allowed domains restrict which verified IdP email addresses may enter the workspace. Automatic provisioning creates a member at the configured default role; disabling it requires the user to exist in the workspace before SSO succeeds.

Configure SCIM

Create a named token in Settings → Identity. Copy it immediately and configure your directory with the displayed base URL and bearer token. The token is never shown again.

Base URL: https://sendix.dev/scim/v2/<workspace-id>
Authorization: Bearer scim_...
Content-Type: application/scim+json

Sendix exposes ServiceProviderConfig and Users. User listing,userName eq filtering, create, get, role patch, active deprovisioning, and delete are supported. Bulk, password change, groups, sorting, and ETags are not currently advertised as supported.

Provisioning lifecycle

1. SCIM creates or finds the global account by normalized email.
2. Sendix adds the account only to the token's workspace and assigns its SCIM role.
3. OIDC links the verified issuer subject to that account and issues a Sendix session.
4. Deprovisioning removes workspace membership; it does not delete unrelated workspaces.
5. The workspace owner is immutable through SCIM and cannot be deprovisioned.

Security behavior

OIDC client secrets use authenticated AES-256-GCM envelope encryption. SCIM bearer tokens are stored only as SHA-256 hashes with a short display prefix, can expire, and can be revoked immediately. SSO and identity administration emit workspace audit records.

Test before enforcing your IdP policy

Keep an owner session open, save the OIDC configuration, and use “Test SSO login” before changing access rules in the identity provider. Sendix does not currently force all password logins for a domain through SSO.