# SSO & enterprise deployment

## Deployment models

| Model | Control plane | Ingress |
|-------|---------------|---------|
| SaaS | `app.blekline.com` | MCP stdio + `/api/ingress/v1/*` |
| Private tenant | Customer subdomain or VPC | Same API surface, customer data residency |
| Sidecar | Daytona / k8s pod | `packages/ingress-proxy` Docker image |

## SSO status

| Method | Status | Notes |
|--------|--------|-------|
| Google / LinkedIn OAuth | **Shipped** | Dashboard login via NextAuth |
| Enterprise OIDC (Okta, Azure AD) | **Shipped** | Configure IdP per steps below |
| SAML SP | **Enterprise program** | Contact sales for timeline |

Enterprise workspaces integrate IdP at the **dashboard** layer (NextAuth-compatible OIDC).

### Okta / Azure AD OIDC (dashboard)

1. Create an OIDC app in your IdP with redirect URI: `https://app.blekline.com/api/auth/callback/oidc` (adjust for your deployment).
2. Set env on Blekline deployment: `OIDC_ISSUER`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`.
3. Map `email` claim to workspace membership (invite users by email before first login).
4. Use workspace API tokens (`mask:write`, `events:write`) for agent runtimes — separate from human SSO.

### SAML roadmap

Planned SAML attributes:

- `email` → workspace membership mapping
- `groups` → role (`owner` / `admin` / `member`)
- `tenant_id` → workspace isolation

Until SAML ships, use OIDC above or Google/LinkedIn for pilot tenants.

Agent runtimes use workspace API tokens (`mask:write`, `events:write`) — separate from human SSO. SCIM-style roster via `/api/workspace/roster` where enabled.

## Policy push

Fleet sensors subscribe to `GET /api/workspace/policy-stream` (SSE). On `policy` events, refresh local allow/deny caches for MCP proxy and ingress sidecars.

## Hardening checklist

- [ ] Rotate workspace API tokens quarterly
- [ ] Set MCP tool denylist for destructive tools (`rm`, `drop_database`, etc.)
- [ ] Enable ingress block mode (`BLEKLINE_INGRESS_BLOCK_HIGH_RISK=true`)
- [ ] Export audit logs to SIEM (`/api/integrations/siem`)
- [ ] Run Cursor model matrix QA (`demo/cursor/model-matrix.md`)

## Support

Enterprise leads: `/api/enterprise/lead` or sales@blekline.com.

---

**Next steps:** [AI Enablement Stack](/docs/introduction/ai-enablement-stack) · [Deployment](/docs/enterprise/deployment) · [Architecture](/docs/introduction/architecture) · [Open workspace](https://app.blekline.com) · [Report issue](https://github.com/Blekline/blekline-oss/issues/new?template=bug_report.yml)