Single sign-on and directory sync

Setup happens on your identity provider’s hosted portal, not in Overlane. Overlane issues a short-lived link, shows the state of the connection and tests it. It never sees your identity provider’s admin credentials, and no provider-specific type appears in the API: a connection is saml or oidc, a directory is dsync.

Set up single sign-on

overlane enterprise sso link
overlane enterprise status

sso link prints a link that expires in minutes; open it yourself or hand it to whoever administers the identity provider. The link is the credential, so it is shown once and never written to a log. Issuing a link is recorded in the audit log with who asked.

The same step is the Set up single sign-on button in Enterprise settings (overlane.app/<workspace>/settings/enterprise/), which then shows the connection as Not set up, Setup in progress, Active or Failed, with the protocol, the domains and when it was last tested. Test connection checks the connection end to end and records the result.

Set up the directory

overlane enterprise sso link --intent dsync
overlane enterprise sso sync

Once the directory is connected, a sync reads it and applies it:

• a person marked inactive in the directory loses access: their agent tokens are revoked, their sessions end, the runs they started are ended with a record and the task leases they hold are released;
• a person’s groups set their role, within the cap in Mapping groups to roles;
• the owner role is never changed from the directory.

Removal takes effect within five minutes

A sync runs every five minutes on its own, and enterprise sso sync runs one now. Each removal is applied once, however many times the directory reports it, and the report states how many seconds it took against the five-minute deadline. A removal that was applied later than that is reported as such rather than hidden.

Removing a person through the directory follows exactly the same path as removing a member in teams and roles, so the same things are released.

Plans

Single sign-on and directory sync are included from the Business plan up.