# SSO for Dashboard

API7 Dashboard supports Single Sign-On (SSO) to centralize user management and improve security. By integrating with your corporate identity provider (IdP), users can log in to the dashboard using their existing credentials, eliminating the need for separate dashboard accounts.

## Supported Protocols[​](#supported-protocols "Direct link to Supported Protocols")

| Protocol                                                                      | Description                                                            | Common Providers                              |
| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------- | --------------------------------------------- |
| [OIDC](https://docs.api7.ai/api7-gateway/security-and-compliance/sso-oidc.md) | OpenID Connect, a modern OAuth 2.0-based protocol                      | Keycloak, Microsoft Entra ID, Auth0, Okta     |
| [SAML](https://docs.api7.ai/api7-gateway/security-and-compliance/sso-saml.md) | SAML 2.0, an XML-based federation protocol                             | Microsoft Entra ID, Okta, Ping Identity, ADFS |
| [LDAP](https://docs.api7.ai/api7-gateway/security-and-compliance/sso-ldap.md) | Lightweight Directory Access Protocol, direct directory authentication | OpenLDAP, Microsoft Active Directory, FreeIPA |
| CAS                                                                           | Central Authentication Service                                         | Apereo CAS                                    |

## Key Capabilities[​](#key-capabilities "Direct link to Key Capabilities")

* **Multiple Login Options**: Configure multiple SSO providers simultaneously. Users see all enabled options on the login page.
* **Automatic Role Mapping**: Map IdP attributes (user fields, group memberships) to API7 roles, synchronized on each login.
* **Permission Boundary Mapping**: Automatically assign permission policies based on IdP attributes.
* **Built-in Login**: The built-in username/password login option can coexist with SSO providers or be disabled.

note

At least one login option must remain enabled at all times. You cannot delete or disable the last remaining enabled option.

## Choosing a Protocol[​](#choosing-a-protocol "Direct link to Choosing a Protocol")

* Use **OIDC** if your IdP supports it — it is the most widely adopted modern SSO protocol and offers the simplest integration.
* Use **SAML** if your organization requires SAML 2.0 federation (common in enterprises with Microsoft Entra ID or Okta).
* Use **LDAP** if you need to authenticate directly against a directory service without browser redirects (e.g., for environments where only CLI or programmatic access is available).

## Getting Started[​](#getting-started "Direct link to Getting Started")

1. [Configure SSO with OIDC](https://docs.api7.ai/api7-gateway/security-and-compliance/sso-oidc.md) — Recommended for most deployments.
2. [Configure SSO with SAML](https://docs.api7.ai/api7-gateway/security-and-compliance/sso-saml.md) — For SAML 2.0 federation requirements.
3. [Configure SSO with LDAP](https://docs.api7.ai/api7-gateway/security-and-compliance/sso-ldap.md) — For direct directory authentication.

## Additional Resources[​](#additional-resources "Direct link to Additional Resources")

* [SSO Overview (Enterprise Feature)](https://docs.api7.ai/api7-gateway/enterprise-features/dashboard-sso.md)
* [SCIM Provisioning for Dashboard](https://docs.api7.ai/api7-gateway/security-and-compliance/authenticate/scim.md)
* [SCIM Provisioning with Okta](https://docs.api7.ai/api7-gateway/security-and-compliance/authenticate/scim-okta.md)
* [SCIM Provisioning with Microsoft Entra ID](https://docs.api7.ai/api7-gateway/security-and-compliance/authenticate/scim-microsoft-entra-id.md)
* [Role-Based Access Control](https://docs.api7.ai/api7-gateway/security-and-compliance/role-based-access-control.md)
* [Permission Policy Examples](https://docs.api7.ai/api7-gateway/reference/permission-policy-examples.md)