Latitude 10 docs

SSO

On Business and Enterprise, members can sign in through your company's identity provider. It's OpenID Connect only, with the authorization code flow, PKCE and a nonce. There's no SAML.

Tested end to end with Okta.

1. Register an app with your provider

Create an OpenID Connect web app with this callback URL:

https://latitude10.tech/api/workspace/auth/sso/callback

The callback's path is /api/workspace/auth/sso/callback.

2. Connect it

Owners do this on the workspace's SSO settings page: enter the provider's issuer URL, the app's client id and its secret. The provider's endpoints are found from the issuer by discovery. The secret is sealed and never shown again.

3. Prove your email domains

Your provider is trusted only for addresses on domains the workspace has proved: see Email domains.

4. Test it

Run a test sign-in goes through the provider once and shows the claims it sent. It passes when your email is on a proved domain, and your session doesn't change. A passing test is recorded on the connection.

5. Require it, if you want

With Require SSO on, members get into the workspace only with a session made through this connection in the last 12 hours. Owners keep a logged way in if the provider breaks: see Break-glass.

What we ask for and use

  • The scopes openid email profile.
  • sub, which ties the provider's user to one account here.
  • email, which must be on a proved domain, and isn't accepted when email_verified is false.
  • name, for display.

An account is tied to the provider's sub. If a provider's user signs in with an address that another account here already has, the sign-in is refused, so an account can't be taken over by changing the provider's records.

New people

Optionally, people with an address on a proved domain who aren't members yet can join on their first SSO sign-in, as viewers or editors, while a seat is free. Without it, they need an invitation.

Where this comes from

  • app/enterprise/_lib/sso.ts
  • app/enterprise/_lib/gate.ts
  • app/enterprise/_lib/domains.ts
  • app/hosted-mcp/_lib/idp.ts
  • app/api/workspace/auth/sso/callback/route.ts
  • app/workspace/enterprise-actions.ts
  • docs/runbooks/enterprise.md