Single Sign-On

liwan supports sign-in through Google Workspace, Microsoft Entra ID, or any OIDC-compliant provider. You can configure one provider at a time. Password sign-in is always available, even when SSO is enabled.

Configure a Provider

Under Settings > Authentication, copy the Callback URL to register with your provider.

Google

1. Create OAuth credentials for a web application and add liwan’s callback URL as an authorized redirect URI.
2. Under Settings > Authentication, select Google and enter the client ID and secret.

To restrict sign-in to accounts managed by your organization, enter a Google Workspace domain.

Microsoft Entra ID

1. Register a web application and add liwan’s callback URL as a Web redirect URI.
2. Create a client secret and note the application (client) ID and directory (tenant) ID.
3. Under Settings > Authentication, select Microsoft Entra ID and enter those values.

Only work or school accounts in the configured tenant can sign in.

OpenID Connect

1. Create a confidential web client with liwan’s callback URL as an allowed redirect URI. See the Keycloak or Dex documentation for provider-specific steps.
2. Under Settings > Authentication, select OpenID Connect and enter the button label, client ID, secret, and issuer URL.

The issuer must support OpenID Connect discovery and ID tokens. Its URL must use HTTPS, except for loopback addresses during local development.

Sign-In Options

• Allow new users creates a regular User account on first sign-in. If disabled, only previously linked external identities can sign in. Matching a password account by username does not link it automatically.
• Reuse provider session uses an existing provider session instead of prompting for credentials again.

Team Assignment

Under Settings > Authentication, select a Default team for new accounts. For Microsoft Entra ID, you can also map group IDs to teams. For OpenID Connect, set the Group claim from the ID token and map its values to teams. Add any scopes needed to receive that claim under Additional scopes. Google supports a default team but not group mappings.

Team assignments are set when accounts are created, not updated at later sign-ins. If group mappings are configured but the provider omits groups or returns an incomplete list, account creation fails.

Save the settings and verify that you can sign in with the provider.