AdministrationPeople and access

Sign-in and accounts

Single sign-on, how accounts are created, passwords and account deletion.

Sign-in is configured per installation by an instance administrator, under Admin → Configuration → Authentication. On OvalBee Cloud it’s managed for you.

Single sign-on

OvalBee signs people in through external identity providers:

  • OpenID Connect — any OIDC provider, such as Microsoft Entra ID, Okta, Google Workspace, Keycloak or Auth0,
  • Google,
  • GitHub.

Add a provider under External providers → Add provider. You’ll need a client ID and secret from your identity provider, and for OIDC its issuer URL. The table of providers shows the callback URL to register on the identity provider’s side — it’s built from the installation’s Public URL, so set that first.

Each provider has a few switches that decide how sign-in meets existing accounts:

SettingWhat it does
Allowed domainsOnly accept people whose email is in these domains, for example your company’s.
Auto-create usersCreate an OvalBee account the first time someone signs in through the provider. Off means only people who already have an account can use it.
Auto-link verified emailAttach a provider sign-in to an existing account with the same verified email.
EnabledShow the provider on the sign-in page as Continue with ….

A new account created through sign-in gets a personal workspace. Add people to your team’s workspaces as described in Members and roles.

SAML and SCIM provisioning aren’t supported yet. The identity providers listed above all offer OpenID Connect alongside SAML, so in practice connecting over OIDC works with the same directory.

Other ways accounts are created

  • Invitations. Workspace owners and admins invite people by email. The invitation link creates an account or adds the workspace to an existing one.
  • Instance administrators create accounts directly under Admin → Configuration → People, with a username, email, name, role and password.
  • Signup form. Off by default. When an administrator turns on Signup form, the sign-in page offers Create an account to anyone who can reach it. Signup identifier decides whether people register with a login or an email, and Signup confirmation email requires them to confirm the address.

Passwords

People who sign in with a password change it from their profile, in the menu at the bottom of the main sidebar. Self-service Forgot password? on the sign-in page is available when the installation identifies accounts by email, sends signup confirmation emails and has email configured. Otherwise an instance administrator sets a new password with Set password in People.

Sessions and protection

Also under Authentication:

  • Token lifetimes — how long a sign-in stays valid before it has to be refreshed, and how long a session lasts in total.
  • Secure cookies — turn on when OvalBee is served over HTTPS.
  • Bot protection — Cloudflare Turnstile checks on the public forms, for installations reachable from the internet.

Deactivating and deleting accounts

An instance administrator can Deactivate user in People, which blocks sign-in and keeps everything else, and Reactivate user later.

People can also delete their own account: profile → Delete account, confirmed by typing DELETE. It signs them out, removes their name and email from the profile and frees the email address to be registered again. Flows, datasets and other work they created stay in their workspaces. Only an instance administrator can bring the account back. The last remaining instance administrator can’t delete their own account.