Single sign-on
NuBench ships with an enterprise identity provider (Authentik) deployed inside your single-tenant environment. Your team signs in once, and the session works across the chat, admin, and super-admin consoles.
How sessions work
- Sign-in uses the OIDC authorization-code flow against your workspace's
identity provider at
auth.nubench.ai. - A successful sign-in issues a short-lived session token, delivered as an
HttpOnly,Securecookie scoped to your workspace domain. - Sessions expire after one hour; signing out clears the session everywhere.
- Every API call is re-verified at the governance gateway — the browser session is a convenience, not the security boundary.
Connecting your corporate IdP
Federate your existing identity provider so your directory remains the source of truth:
- OIDC — connect Entra ID (Azure AD), Okta, Google Workspace, or any OIDC-compliant provider as an upstream source. Users authenticate against your IdP; NuBench receives only the identity claims needed to map the user to a workspace account.
- SAML 2.0 and SCIM provisioning — in development. SAML source federation and SCIM-based user lifecycle sync are being finalised; contact us if these gate your rollout and we will walk you through current options.
Multi-factor authentication
TOTP-based MFA can be enforced for administrator accounts through the identity provider's policy flows.
Role mapping
Identity provider group claims map to NuBench roles at sign-in. The role gate is enforced twice: at the console router (which console you can open) and at the governance gateway (what the API lets you do). See Roles and permissions.
Break-glass access
Your workspace retains a root administrator account independent of upstream federation, so a misconfigured IdP connection can never lock you out. Keep its credentials in your organisation's password vault and enable MFA on it.