Identity

Every org needs a way to authenticate its members. Swarmfile gives you one out of the box and lets you layer on enterprise identity - SSO, SCIM, and on-prem LDAP sync - as your org grows.

Built-in identity provider#

Every org gets Swarmfile's own OpenID Connect identity provider by default, with email/password authentication. There's no setup required - it's active from the moment your org exists, and for most Starter-plan teams it's all you need.

Bring your own SSO (SAML / OIDC)#

Plan: Pro and above.

If your org already runs an identity provider, you can configure it in Swarmfile instead of - or alongside - the built-in one. Entra ID and Okta are the two explicitly supported and tested patterns, covering both SAML and OIDC.

SSO configuration is per-org, and each org's config is hard-bound: when a member signs in, the token they present is validated against the JWKS for that org's specific configured issuer. One org's SSO setup can't be used to forge identity into another org, even if both orgs use the same upstream IdP vendor.

If an external IdP config is ever misconfigured badly enough to lock everyone in the org out, the owner has a break-glass path back to the built-in Swarmfile IdP. This is an owner-only safety net - don't rely on it as a routine way to bypass SSO.

SCIM provisioning#

Plan: Pro and above.

SCIM 2.0 lets your identity provider push user provisioning and deprovisioning into Swarmfile directly, instead of relying on manual email invites. Requests are authenticated with a bearer token you generate for the integration.

Entra and Okta each use slightly different PATCH conventions for SCIM group and user updates. Swarmfile handles both dialects, so you can point either one at the same endpoint without translation on your end.

On-prem LDAP sync#

Plan: Pro and above.

If your org's directory lives on-prem - LDAP or Active Directory rather than a cloud IdP - you run a sync agent on your own infrastructure (for example, as a Docker container pointed at your AD) instead of connecting a hosted IdP. The agent syncs your directory into Swarmfile's membership model on your schedule, without your directory ever needing to be reachable from outside your network.

Plan gating and what happens on downgrade#

SSO, SCIM, and LDAP sync are all Pro+ features, and the restriction is enforced server-side - not just hidden in the UI. Calling an SSO, SCIM, or LDAP endpoint on a Starter-plan org returns a real 402 rejection, not a silently-ignored request.

Downgrades don't retroactively break things. If an org drops below Pro while SSO or SCIM is already configured, the existing configuration keeps working - turning it off automatically would strand people mid-login or silently break provisioning. The gate only applies going forward: on a Starter plan, you can't set up something new, but nothing already running gets switched off underneath you.

For plan comparisons and pricing, see Billing & Plans. For what an authenticated member can actually access once signed in, see Permissions. Setting up SSO/SCIM before you push installers to a fleet is what makes first sign-in zero-touch - see Deploying to Your Team.