Get started

Enterprise

SSO & enterprise deployment

Enterprise SSO roadmap, deployment models, and hardening checklist.

View as Markdown

Operations runbook: For SAML/OIDC/SCIM cutover steps, see SSO & SCIM runbook.

Deployment models

ModelControl planeIngress
SaaSapp.blekline.comMCP stdio + /api/ingress/v1/*
Private tenantCustomer subdomain or VPCSame API surface, customer data residency
SidecarDaytona / k8s podpackages/ingress-proxy Docker image

SSO status

MethodStatusNotes
Google / LinkedIn OAuthShippedDashboard login via NextAuth
Enterprise OIDC (Okta, Azure AD, Entra)Shipped (R2)Generic OIDC when env vars are set
SAML SPEnterprise programContact sales for timeline
SCIM 2.0Shipped (R2)/api/scim/v2/Users — SCIM bearer from Admin → Security

Enterprise workspaces integrate IdP at the dashboard layer (NextAuth-compatible OIDC). Invite users by email before first OIDC login — pending invites auto-join the enterprise workspace.

Okta / Azure AD OIDC (dashboard)

  1. Create an OIDC app in your IdP with redirect URI: https://app.blekline.com/api/auth/callback/oidc (adjust for your deployment).
  2. Set env on Blekline deployment:
    • OIDC_ISSUER — IdP issuer URL (no trailing slash)
    • OIDC_CLIENT_ID
    • OIDC_CLIENT_SECRET
    • OIDC_PROVIDER_NAME — optional button label (default: Enterprise SSO)
  3. Invite users by email in Admin → Members before first login.
  4. Map email claim to workspace membership on first sign-in (invite required for net-new users).
  5. Use workspace API tokens (mask:write, events:write) for agent runtimes — separate from human SSO.

SAML roadmap

Planned SAML attributes:

  • email → workspace membership mapping
  • groups → role (owner / admin / member)
  • tenant_id → workspace isolation

Until SAML ships, use OIDC above or Google/LinkedIn for pilot tenants.

Agent runtimes use workspace API tokens (mask:write, events:write) — separate from human SSO.

SCIM 2.0 provisioning

  1. Admin → Security → Issue SCIM token (requires admin 2FA).
  2. Configure your IdP (Entra, Okta) with:
    • Base URL: https://app.blekline.com/api/scim/v2
    • Bearer token: blw_scim_… (shown once)
  3. Map userName / emails[].value to workspace email; users join the enterprise workspace on first login.
  4. Deprovision via active: false or DELETE — revokes sessions and removes membership.

Rate limit: 30 req/min per token. Optional IP allowlist via workspace settings (roadmap UI).

Policy push

Enclave sidecars subscribe to GET /api/workspace/policy-stream (SSE). On policy events, refresh local allow/deny caches for MCP proxy and ingress sidecars.

Hardening checklist

  • Rotate workspace API tokens quarterly
  • Set MCP tool denylist for destructive tools (rm, drop_database, etc.)
  • Enable ingress block mode (BLEKLINE_INGRESS_BLOCK_HIGH_RISK=true)
  • Export audit logs to SIEM (/api/integrations/siem)
  • Run Cursor model matrix QA (demo/cursor/model-matrix.md)

Support

Enterprise leads: /api/enterprise/lead or sales@blekline.com.

Next steps: Architecture · Deployment · Implementation checklist · Open workspace · Report issue