Single sign-on and directory sign-in
Trinium Enterprise signs people in through your identity provider with OpenID Connect, through LDAP or Active Directory, or both. Everything is set in Settings → Authentication, by an administrator.
Before you start
- Single sign-on needs HTTPS. Identity providers refuse a redirect address that is not
https://. Turn on HTTPS first, or put Trinium behind a proxy that serves it. - One provider of each kind. One OpenID Connect provider and one directory. SAML is not supported.
- The provider signs people in; Trinium decides what they may do. No groups need configuring at the provider. A new account gets the default role you choose, and an administrator promotes it.
OpenID Connect
Any provider that implements OpenID Connect works, such as Microsoft Entra ID, Okta, Google and Keycloak. Register Trinium as an application at the provider, then fill in the Single sign-on (OpenID Connect) card:
| Setting | What to enter |
|---|---|
| Issuer URL | The provider's issuer value, not its sign-in page, e.g. https://acme.okta.com/oauth2/default. |
| Client ID | From the application you registered. |
| Client secret | From the same application. |
| Trinium URL | The address people open Trinium at: scheme and host only, e.g. https://trinium.acme.com. |
| Scopes (Advanced) | Leave blank unless your provider needs more than openid email profile. |
The card shows the exact redirect address to register at the provider, with a copy button, worked out from the Trinium URL. Test checks the issuer before you save. The sign-in page then shows a button, with the Button label you set, above the password form.
How a sign-in finds its account. An account already linked to that person at the provider signs in. Otherwise a verified email address that matches an existing account claims it; an unverified address never does. Otherwise, with Create accounts automatically on, a new account is created with the Default role. Turning that switch off never locks out anyone who already signs in this way.
LDAP and Active Directory
People sign in through the ordinary password box with their full address, such as jsmith@acme.com. The part after the @ sends the attempt to the directory; the account itself is called jsmith. A blank password is refused before Trinium contacts the directory. Fill in the Directory (LDAP / Active Directory) card:
| Setting | What to enter |
|---|---|
| Directory domain | The domain people sign in with, e.g. acme.com. Any other username is treated as a local account. |
| Directory URL | e.g. ldaps://dc.acme.com:636. |
| Bind DN | The service account Trinium searches with, e.g. cn=trinium,ou=service,dc=acme,dc=com. |
| Bind password | The service account's password. |
| User search base | Where people are found, e.g. ou=people,dc=acme,dc=com. |
| User filter | Must contain {username}, which receives the name before the @. |
| Unique ID attribute (Advanced) | Stable for each person. |
| Email attribute (Advanced) | Usually mail. |
| Setting | OpenLDAP | Active Directory |
|---|---|---|
| User filter | (uid={username}) | (sAMAccountName={username}) |
| Unique ID attribute | entryUUID | userPrincipalName |
Use StartTLS upgrades a plain ldap:// connection. Accept an unverified TLS certificate exists for internal domain controllers with self-signed certificates; it is a real weakening, and the card says so.
Local passwords
The Sign-in methods card sets Local password sign-in to Allowed or Break-glass only.
- With Break-glass only, everyone signs in through your provider or directory, except the built-in
adminaccount, whose password only you hold. It always works, so a broken provider setting can never lock you out of the instance. - With Allowed, an account that also has a password can use it, which is the way in while the provider is down.
A setting that would leave no way in at all is refused.
Offboarding
Trinium is never told when someone is disabled at your provider. Deactivate them in Users: it takes effect within 15 minutes for anyone already signed in, and immediately for a new sign-in.
Sessions and lockout
A session ends after four hours without activity. Five failed sign-ins for one username within 15 minutes lock that username for 15 minutes, the built-in admin included.
Edition
Single sign-on and directory sign-in are part of Enterprise. A trial includes them; installing a Pro license key turns them off.