Teams and enterprise
Single sign-on
Connect your identity provider to Brunel with OpenID Connect, Google Workspace, Microsoft Entra ID, Okta or any OIDC provider, and optionally require it for every member.
Single sign-on is available on Enterprise. Brunel is an OpenID Connect relying party (authorization code with PKCE); it works with Google Workspace, Microsoft Entra ID, Okta and any standard OIDC provider.
How it works
Members still sign in to Brunel with GitHub. When single sign-on is configured and required, they must also pass your identity provider before using the team's workspace, on every Brunel address. The SSO access lasts the team's maximum session length, or 12 hours by default.
For finer control (who, from where, with which method), use Brunel Access: the same identity provider, with your own allow and block policies.
Configure it
- In your identity provider, create a web application (OIDC):
- Redirect URI:
https://brunel.cloud/api/sso/callback - Grant: authorization code; Brunel uses PKCE.
- Scopes:
openid,email,profile.
- Redirect URI:
- In Enterprise → Security and SSO, enter the issuer URL, the client id and the client secret, then save. Brunel discovers the endpoints from
<issuer>/.well-known/openid-configuration. - Test with your own account, then turn on Require single sign-on for every member.
| Provider | Issuer URL |
|---|---|
| Google Workspace | https://accounts.google.com |
| Microsoft Entra ID | https://login.microsoftonline.com/<tenant-id>/v2.0 |
| Okta | https://<your-domain>.okta.com (or your authorization server's issuer) |
Security
- The issuer must use HTTPS, and outgoing calls go through Brunel's public-address checks.
- ID tokens are verified with the provider's published keys (RS256, RS384, RS512, PS256, ES256, ES384): issuer, audience, expiry and nonce are checked.
- The client secret is sealed (AES-256-GCM) and never shown again.
- Every SSO sign-in is written to the audit log with the identity it used.