Single Sign-On

Configure Limrun as an OIDC service provider. Limrun uses the user's verified email domain to select the organization's OIDC connection.

For the Okta Integration Network setup, see Okta SSO.

Prerequisites

Before you configure SSO, make sure you have:

• Admin access to the Limrun organization.
• Permission to create an OIDC web application in your identity provider.
• Access to the DNS provider for the email domain your users sign in with.
• An email domain that belongs to the Limrun organization.

Supported features

Limrun supports:

• OIDC authorization code flow
• SP-initiated SSO
• IdP-initiated SSO through OIDC third-party initiated login
• Just-In-Time provisioning
• Single Logout
• Universal Logout through Global Token Revocation

Configuration steps

Verify your email domain

Each SSO domain must be verified before users with that domain can sign in through the OIDC connection.

It requires access to your DNS records. If this is not viable, reach out to us for manual verification.

1. Open console.limrun.com.

2. Go to Settings.

3. In Domain Verification, add the email domain that should use SSO.

4. Create the TXT record shown in the verification dialog:

   DNS field	Value
   Type	TXT
   Host / Name	Copy from Limrun.
   Value	Copy from Limrun.

5. After the DNS record is published, click Verify DNS in Limrun.

Create the OIDC application

1. In your identity provider, create a new OIDC application.

2. Choose Web Application as the application type.

3. Use the authorization code flow.

4. Make sure the ID token includes the user's email claim.

5. Name the app Limrun.

6. Add this sign-in redirect URI:

   https://api.limrun.com/authn/oidc/callback

7. If your provider asks for an initiate login URI, add:

   https://api.limrun.com/authn/oidc/login

8. Assign the users or groups that should have access to Limrun.

9. Save the app.

Copy the OIDC values

Copy these values from your identity provider:

The issuer URL is the issuer value from your provider's OpenID configuration document. For example, with Okta:

https://your-org.okta.com/.well-known/openid-configuration

Use the issuer value from that JSON document:

https://your-org.okta.com

Save the connection in Limrun

1. Return to console.limrun.com.
2. Go to Settings > Single Sign-On.
3. Confirm the redirect URI shown in Limrun matches the redirect URI in your identity provider.
4. Enter the Issuer URL, Client ID, and Client Secret.
5. Click Save.

Limrun discovers the provider from the issuer URL and requests the openid, email, and profile scopes.

Optional: configure Single Logout

If your identity provider supports OIDC Single Logout, add the Post Logout Redirect URI shown in Limrun to your OIDC application's allowed logout redirect URIs.

For production, this value is:

https://console.limrun.com/authn/login

When a user signs out of Limrun, Limrun revokes the user's Limrun token and redirects through the provider's end_session_endpoint when the provider publishes one.

Optional: configure Universal Logout

If your identity provider supports Global Token Revocation, configure this endpoint:

https://api.limrun.com/authn/oidc/global-token-revocation

Limrun accepts these subject identifier formats:

SP-initiated SSO

The sign-in process starts from the Limrun Console.

1. Go to console.limrun.com/authn/login.
2. Click Continue with SSO.
3. Enter your work email address.
4. Complete authentication in your identity provider.

If the email domain is verified and the provider sign-in succeeds, Limrun signs the user in and redirects them to the console.

Troubleshoot

Users see "SSO not configured". Confirm the user's email domain is added under Settings > Domain Verification and shows Verified. Limrun only starts OIDC SSO for verified domains.

The provider rejects the redirect URI. Confirm that the redirect URI is exactly https://api.limrun.com/authn/oidc/callback.

The provider returns an ID token without an email. Configure the OIDC app so the ID token includes the user's email claim. Limrun requires the email claim to match the user to a verified organization domain.

A user authenticates with the provider but cannot enter Limrun. Confirm the user's email domain is verified in Limrun and assigned to the same organization as the OIDC connection.

Notes

• Limrun supports OIDC SSO. SAML and SCIM are not configured from this guide.
• A Limrun organization has one OIDC connection.
• If a user signs in through SSO and does not already have a Limrun account, Limrun creates the user and adds them to the organization for that OIDC connection.
• If a user already exists with the same verified email address, a successful OIDC sign-in links that account to the OIDC identity for the organization.