Tenant SSO

SQIP supports one customer-owned OpenID Connect (OIDC) connection per tenant. The customer identity provider authenticates the employee, then SQIP's identity service issues the console token used by the web application and control-plane API.

Employee → customer OIDC provider → SQIP identity service → console and API

SQIP does not trust customer-issued access tokens directly. Tenant SSO does not create Pulsar credentials; applications continue to use namespace-scoped API keys.

Prerequisites

The tenant is active.
You have users:manage-access for the tenant, or you are a platform administrator.
The customer identity provider supports OIDC confidential web applications.
You have its discovery metadata and a client secret.

Register the customer application

Open Access and RBAC → Tenant SSO and select the tenant.
Copy the exact Redirect URI shown under Register the client.
Create a confidential OIDC web application in the customer's provider and register that URI.
Allow the openid, profile, and email scopes.
Copy the client ID, client secret, and endpoints from the provider's OIDC discovery document.

All configured endpoints must be absolute HTTPS URLs without embedded credentials or fragments. Localhost and private, loopback, link-local, multicast, or unspecified IP literals are rejected.

Configure the connection

Field	Value
Connection name	A recognizable provider name, such as `Contoso Entra ID`
Client ID	The OIDC application identifier
Client secret	The confidential application secret
Issuer URL	The provider's HTTPS issuer
Authorization endpoint	The provider's HTTPS authorization endpoint
Token endpoint	The provider's HTTPS token endpoint
JWKS endpoint	The provider's HTTPS signing-key endpoint
Logout endpoint	Optional HTTPS provider logout endpoint
Default tenant role	The baseline role for every user of this connection
Enable immediately	Whether the sign-in route is available after saving

Select Create OIDC connection, then test the displayed Employee sign-in URL with a non-administrator account.

Warning

The default role applies to every person signing in through this provider. Start with user; choose tenant-admin, cluster-admin, or usage-admin only when all users of the provider should receive that baseline in this tenant.

The SSO role is evaluated only for the matching enabled tenant connection and can never grant platform-admin or super-admin. If a person also has an explicit SQIP membership in the tenant, that membership takes precedence.

Update or rotate

The client secret is sent to the identity service and is never stored in SQIP's PostgreSQL database or returned to the console. Enter the secret again on every update, including a metadata change or secret rotation.

To rotate safely:

Create or activate the new secret at the customer provider.
Enter the complete connection configuration and new secret in SQIP.
Select Update OIDC connection.
Test the employee sign-in URL in a fresh browser session.
Retire the old secret at the provider.

Disable or remove

Clear Enable this connection immediately and save to retain the configuration while stopping new SSO authorization. Select Remove to delete the broker configuration and its generated tenant role.

Disabling or removing the connection prevents its role from authorizing requests made with freshly issued tokens. Review tenant_oidc.configured and tenant_oidc.deleted in Audit Logs.

Note

This integration covers OIDC authentication and a single default role. SAML, LDAP federation, SCIM provisioning, and group-to-role mapping are not part of this workflow.