Skip to navigation
Core conceptsIdentity and access

Single sign-on

View as Markdown
Enterprise

Overview

Unleash provides single sign-on (SSO) support through SAML 2.0, OpenID Connect, and username/password authentication.

To configure SSO, navigate to Admin settings > Single sign-on in the Unleash Admin UI. Admin access is required.

For step-by-step configuration instructions, refer to the following guides:

Session length and re-authentication

v8.3

SSO settings do not control how long a session lasts. For self-hosted instances, you set the maximum session length and the idle timeout with environment variables. See Session timeouts.

When UNLEASH_EXPERIMENTAL_SESSION_TIMEOUTS is true, Unleash asks your identity provider to re-authenticate the user each time they start an SSO sign-in from Unleash, instead of reusing an existing identity provider session:

  • SAML 2.0: Unleash sets ForceAuthn in the authentication request.
  • OpenID Connect: Unleash sends the prompt=login and max_age parameters.

Your identity provider decides whether to honor the request, and behavior varies between providers. For example, Okta honors ForceAuthn only when Honor Force Authentication is enabled for the application. If the identity provider does not re-authenticate the user, Unleash still completes the sign-in and logs a warning.