Enterprise identity - shipd

Overview

Identity configuration belongs to an organization. OIDC authenticates users; optional inbound SCIM manages membership. SAML is not supported.

Authentication rules

Control	Behavior
OIDC	Signed ID token, issuer, client audience, expiry, state, nonce and PKCE checks
Domain routing	Requires verified ownership and an enabled provider; ambiguous selection requires a provider ID
Linking	Work email must belong to the provider’s verified domain; SCIM linking preserves an existing verified account’s profile
Provisioning	New members receive `viewer`; active SCIM requires an active directory identity matched by OIDC subject
Enforced SSO	Checked for the destination organization, including existing browser and CLI sessions
Owner recovery	Independent password/passkey remains available; required shipd MFA still applies
MFA	A successful shipd challenge is required; enrollment or IdP MFA claims alone do not satisfy it
Provider change/removal	Provider sessions must authenticate again; removal requires independent credentials and directory decommissioning
Password compatibility	Password login remains available; it does not unlock an enforcing organization for non-owners

Offboarding

Directory deactivation removes ordinary and administrator memberships. Owners remain for recovery and must be removed or transferred explicitly. Directory-inactive owners cannot authenticate through that SCIM identity. IdP logout alone does not end shipd sessions; revoke sessions or deactivate through SCIM.

Errors and audit

Login failures show a generic error. Provider secrets and tokens are excluded from audit payloads. Provider configuration, domain verification, enforcement, provisioning, and recovery policy changes are audited. Related: Connect organization single sign-on · Provision members with SCIM · SCIM provisioning.