Skip to content

Authentication

XTM One supports local accounts and single sign-on (SSO) via OIDC and SAML 2.0. Authentication is configured from Settings → Authentication in the UI.

Local accounts

By default, users authenticate with email and password. Admins create accounts from Settings → Users, or users self-register if enabled.

The admin account (ADMIN_EMAIL / ADMIN_PASSWORD) is created or updated on every startup from environment variables.

OIDC (OpenID Connect)

Use OIDC to integrate with identity providers like Azure AD, Okta, Google Workspace, or Keycloak.

What you need

  • A registered OAuth 2.0 application in your IdP
  • Client ID and client secret
  • The issuer URL (well-known discovery endpoint)
  • A redirect URI: {BASE_URL}/api/auth/oidc/callback

Configuration

All OIDC settings are configured from Settings → Authentication → OIDC in the UI. No environment variables needed.

User provisioning

Users are created automatically on first login. The email claim is used to match existing local accounts — if a user with the same email already exists, the accounts are linked.

SAML 2.0

Use SAML for enterprise identity providers that do not support OIDC, or when your organization requires SAML assertions.

What you need

  • Your IdP metadata URL or XML
  • The ACS (Assertion Consumer Service) URL: {BASE_URL}/api/auth/saml/acs
  • The Entity ID: {BASE_URL}/api/auth/saml/metadata

Configuration

All SAML settings are configured from Settings → Authentication → SAML in the UI. No environment variables needed.

User provisioning

Users are created automatically on first login, matched by email.

Group mapping

SAML supports automatic group mapping from IdP group claims:

  • When enabled, groups from the SAML assertion are synced on each login.
  • Users are added to matching groups and removed from groups no longer present in the assertion.
  • If Auto-create groups is enabled, groups from the assertion that do not exist in XTM One are created automatically.

Group mapping is configured from Settings → Authentication → SAML.

Access provisioning summary

Method How users are created
Admin invitation Admin creates accounts from Settings → Users
Self-registration Users register with a valid email (if enabled by admin)
SSO auto-provisioning Users are created on first OIDC or SAML login

Next step

Once authentication is configured, proceed to Administration to manage users, groups, and permissions.