Skip to main content

Security & SSO Overview

FrontLine supports enterprise Single Sign-On (SSO) alongside native email/password authentication. Tenant administrators configure authentication policies, SSO providers, and MFA requirements from Settings → Security & SSO.

Authentication modes​

ModeDescription
Enterprise SSO — OIDCOAuth 2.0 + OpenID Connect with PKCE. Recommended for most providers.
Enterprise SSO — SAML 2.0SP-initiated and IdP-initiated SAML assertion flows.
Native email/passwordBuilt-in login with mandatory MFA. Available when SSO is not enforced or for break-glass accounts.

Supported identity providers (Wave 1)​

  • Microsoft Entra ID (OIDC and SAML)
  • Okta (OIDC and SAML)
  • Google Workspace (OIDC and SAML)
  • Custom OIDC provider (via discovery URL)
  • Custom SAML 2.0 provider (via metadata XML)

Tenant authentication policies​

These settings control how users in your tenant authenticate:

SettingDefaultDescription
Enforce SSOOffWhen enabled, native email/password login is blocked for all users except break-glass accounts.
Allow native break-glassOffPermits designated admin accounts to use native login even when SSO is enforced.
MFA requiredOn (native accounts)MFA is mandatory for all native login sessions. Can be elevated to require MFA for all session types.
Device trustOnAllows users to skip MFA for up to 30 days on trusted devices after a successful MFA challenge.
Device trust TTL30 daysHow long a trusted device cookie remains valid (1–90 days).
JIT provisioningOffAutomatically create FrontLine user accounts on first SSO login.

Pre-configuration checklist​

Before setting up SSO, confirm the following:

  1. You have admin access to your identity provider (Entra ID, Okta, Google Workspace, or custom).
  2. You know which email domains should route to the SSO provider.
  3. You have decided whether to enforce SSO (block native login) or allow both.
  4. You have identified any break-glass accounts that need native login access when SSO is enforced.
  5. You have decided on a default role for JIT-provisioned users (if enabling JIT).

Go-live checklist​

After configuring your SSO provider:

  1. Test with a pilot user — log in via SSO with one account before enforcing for all users.
  2. Verify claim mappings — confirm that email, first name, and last name are mapped correctly.
  3. Check JIT provisioning — if enabled, verify the new user record is created with the correct default role.
  4. Enable enforcement — once tested, set Enforce SSO to block native login for non-break-glass users.
  5. Communicate to users — notify your team of the new login flow and the SSO provider they should use.
  6. Verify break-glass access — confirm designated admin accounts can still log in via native email/password.
tip

Start with SSO enforcement off during initial setup. Enable it only after confirming SSO login works for at least one user.

Next steps​