Set up SSO and SCIM

Single sign-on lets people use your identity provider to open Lanternfish, and SCIM keeps the member list in sync so new joiners get access and leavers lose it without anyone clicking a button. Both are included on the Enterprise plan.

Lanternfish supports SAML 2.0 and OpenID Connect, and has ready-made guides for Okta, Microsoft Entra ID and Google Workspace. You need to be a workspace owner, plus an admin in your identity provider.

Turn on SSO

1. Open Settings, then Security, and choose Single sign-on.

2. Copy the sign-in URL and the entity ID shown there into a new application in your identity provider.

3. Paste the metadata URL from your identity provider back into Lanternfish and select Test connection.

4. Sign in with a different account in a private window to confirm it works.

5. Select Require SSO for everyone. Existing sessions end the next time they refresh.

To add SCIM, choose Provisioning on the same page and generate a token. Paste the token and the base URL into your identity provider and assign groups to the app. Role mapping works from group names, such as lanternfish-admins.

Keep one owner account that can sign in with a password, so a problem with your identity provider can’t lock you out of the workspace.