Enterprise

Enterprise SSO

Let members sign in through your identity provider via OIDC or SAML, with email-domain routing. Active Directory connects through AD FS or Entra ID.

Enterprise SSO lets your members authenticate through your own IdP instead of a backlex password. Configure it under Settings → Enterprise SSO (or the API). Both OIDC and SAML are supported.

Email-domain routing

Set an email domain (e.g. acme.com) and the sign-in page offers “Sign in with SSO” for anyone using that domain, routing them to your IdP.

Verifying your email domain

Until the domain is verified, it is used for routing only, and your IdP can sign in only people you have already invited to the organization. This is deliberate: you control your own IdP, so an assertion on its own proves nothing about whether the asserted address belongs to you. Verification is what establishes that.

In Settings → Enterprise SSO, save your email domain and choose Verify domain. Publish the TXT record shown:

Name:  _backlex-verify.acme.com
Value: backlex-verify=<token>

then choose check now. Once verified, anyone with an address on that domain can sign in through your IdP and be seated automatically with the configured default role — no invite needed.

Changing the email domain clears the verification, so re-run the challenge for the new domain.

Members who haven’t been invited and whose domain isn’t verified get a clear error at sign-in telling them to accept their invitation or ask an admin to verify the domain.

OIDC

Provide issuer, client ID, client secret, and optional scopes. Give your IdP the redirect URI shown in settings:

https://cloud.backlex.com/api/sso/callback

SAML

Provide your IdP entity ID, SSO URL, and signing certificate (PEM). Give your IdP the ACS URL and SP entity ID shown in settings:

ACS URL:       https://cloud.backlex.com/api/sso/saml/<org>/acs
SP entity ID:  https://cloud.backlex.com/api/sso/saml/<org>/metadata

Active Directory

There’s no direct LDAP — the standard path (the same one Cloudflare Access uses) is to front AD with one of:

AD FS — connect via SAML; AD FS maps LDAP attributes to claims.
Entra ID / Azure AD — connect via OIDC.

Both work with the options above; no LDAP polling required.

Configuring and disabling SSO requires the admin role. Provision members automatically with SCIM.