Connecting any other identity provider (generic OIDC + SCIM)

Not on Okta, Entra ID, or Google Workspace? Landfall's sign-in and provisioning are both implemented against open standards — OpenID Connect discovery for sign-in, SCIM 2.0 (RFC 7643/7644) for provisioning — so any standards-compliant provider works the same way these guides describe for the named three, using the values below instead of a specific console's screens.

What you'll need

• Your provider's OIDC discovery document URL (or its issuer, if discovery is at the standard well-known path).
• The ability to register a confidential OIDC client (one that can hold a client secret) in your provider.
• For provisioning: your provider's own SCIM 2.0 client configuration screen, wherever it lives.
• An admin seat on your Landfall organization.

Part 1 — Sign-in (OIDC)

1. Register a confidential OIDC client for Landfall

   In your provider's own console, register a new application/client as Authorization Code flow, confidential (a client secret, not public/PKCE-only — Landfall's server holds the secret and exchanges the code server-side).

2. Redirect URI

   Open Landfall's Settings → Security → Single sign-on panel first for the exact value to register:

   https://<your-landfall-domain>/o/<your-org-slug>/auth/sso/callback

3. Issuer and discovery

   Landfall fetches your provider's configuration from <issuer>/.well-known/openid-configuration. If your provider publishes discovery at a different path, Landfall's panel accepts an explicit discovery URL override alongside the issuer — use it if the standard path 404s.

4. Scopes, client ID and secret, then test and activate

   Request at minimum openid, email, and profile (Landfall's default). Paste the client ID and secret into Landfall's panel, save, run a test sign-in as yourself, then activate — required before anyone else can sign in through this provider.

Part 2 — User provisioning (SCIM)

1. Enable SCIM in Landfall first

   In Landfall's Settings → Security → SCIM provisioning panel, click Enable SCIM. Copy the base URL and the one-time bearer token.

2. Configure your provider's SCIM client

   In your provider's own SCIM/provisioning configuration, set the base URL to the value from Landfall's panel, and configure it to send the bearer token as a standard Authorization: Bearer <token> header on every request — the RFC 7644 §2.1 OAuth Bearer Token authentication scheme, which is what Landfall's SCIM endpoint expects (advertised at its own /ServiceProviderConfig discovery endpoint).

3. Users and Groups

   Landfall implements the SCIM Users resource (create, read, filter by userName, patch — including the active:false operation your provider sends to deprovision someone) and a minimal Groups resource used only to carry a group's displayName for role resolution — Landfall does not model group membership beyond that.

4. Map a group to a Landfall role (optional)

   A provisioned person's role comes from the group(s) your provider sends on their User resource. Add a row in Landfall's SCIM panel (group display name → role key) for any group you want to grant a specific role; an unmapped group falls back to Landfall's default role. This mapping is admin-configured only — your provider's own sync traffic can read from it but can never write or change it.

This guide describes Landfall's own implementation of the OIDC and SCIM 2.0 standards, last verified against Landfall's contract for this feature: 2026-09-11.