Skip to content

Public multi-tenant sign-in (SSO)

Internally, Totlcom signs in through Cloudflare Access (Entra SSO). That doesn't scale to selling the product to other MSPs, who want their own users to sign in with their own domains and identity provider. For the public product the portal instead authenticates users through an OIDC broker (WorkOS or Auth0), and the API maps each verified login to the right tenant.

How it works

  1. The customer signs in via the broker (WorkOS/Auth0), which federates to whatever IdP they use (Entra, Okta, Google, …) and issues a signed JWT.
  2. The portal calls the API with Authorization: Bearer <JWT>.
  3. The Worker verifies the JWT against the broker's JWKS and checks issuer / audience / expiry (RS256, unit-tested round-trip). Internal Cloudflare Access continues to work in parallel and is tried first.
  4. The verified identity is mapped to a tenant via the tenant_idp table — by the broker's org id (organization_id / org_id) or by email domain. On first login the user is provisioned just-in-time with the role you configured.
Customer IdP → WorkOS/Auth0 (JWT) → Worker verifies (JWKS) → tenant_idp maps org/domain → tenant + role

An explicit user row always wins over a mapping, so you can still grant cross-tenant roles like provider to specific people.

Configure the broker

Set these on the Worker (blank = internal-only, unchanged):

# In backend/wrangler.toml [vars], or as secrets:
#   OIDC_ISSUER    e.g. https://api.workos.com/  (or your Auth0 domain)
#   OIDC_AUDIENCE  the audience/client id your tokens carry (optional but recommended)
#   OIDC_JWKS_URL  the broker JWKS, e.g. https://api.workos.com/sso/jwks/<client_id>
wrangler deploy --config backend/wrangler.toml

Map customers to tenants

In a customer's workspace open Sign-in / SSO and add a mapping:

  • Email domain — every user at contoso.com resolves to this customer.
  • Org id — the broker's organization identifier (most precise; survives domain changes).

Choose the role new users get (engineer, admin, readonly). Remove a mapping to stop new logins resolving through it (existing provisioned users keep their access until you remove them under Users).

Security notes

  • Only tokens signed by the configured issuer's keys are accepted; tampered tokens fail the signature check (covered by tests).
  • JIT provisioning caps the granted role — a tenant admin cannot mint a provider; only a provider can.
  • The mapping table is tenant-scoped and edited only by users who can manage that tenant.