> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useshipd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise identity

> OIDC, organization access, account linking, sessions, and recovery rules.

## Overview

Identity configuration belongs to an organization. OIDC authenticates users; optional inbound SCIM manages membership. SAML is not supported.

## Authentication rules

| Control | Behavior |
| - | - |
| OIDC | Signed ID token, issuer, client audience, expiry, state, nonce and PKCE checks |
| Domain routing | Requires verified ownership and an enabled provider; ambiguous selection requires a provider ID |
| Linking | Work email must belong to the provider's verified domain; SCIM linking preserves an existing verified account's profile |
| Provisioning | New members receive `viewer`; active SCIM requires an active directory identity matched by OIDC subject |
| Enforced SSO | Checked for the destination organization, including existing browser and CLI sessions |
| Owner recovery | Independent password/passkey remains available; required shipd MFA still applies |
| MFA | A successful shipd challenge is required; enrollment or IdP MFA claims alone do not satisfy it |
| Provider change/removal | Provider sessions must authenticate again; removal requires independent credentials and directory decommissioning |
| Password compatibility | Password login remains available; it does not unlock an enforcing organization for non-owners |

## Offboarding

Directory deactivation removes ordinary and administrator memberships. Owners remain for recovery and must be removed or transferred explicitly. Directory-inactive owners cannot authenticate through that SCIM identity. IdP logout alone does not end shipd sessions; revoke sessions or deactivate through SCIM.

## Errors and audit

Login failures show a generic error. Provider secrets and tokens are excluded from audit payloads. Provider configuration, domain verification, enforcement, provisioning, and recovery policy changes are audited.

Related: [Connect organization single sign-on](/enterprise/sso) · [Provision members with SCIM](/enterprise/scim) · [SCIM provisioning](/reference/scim).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.