External identity and SSO

External identity lets users authenticate through a central Moltaro Identity service. Each Moltaro workspace remains independent: it keeps its own local users, roles, permissions, access tokens, data, and audit history.

One workspace installation has zero or one active external identity connection. The connection supplies authentication and directory information; it never selects a workspace database or grants Moltaro permissions.

What users experience

When a connection is healthy, the login page offers external sign-in. Moltaro uses OpenID Connect Authorization Code flow with PKCE and returns the user to the safe local page they originally opened. A guarded silent sign-in can reuse an existing Moltaro Identity browser session without showing another password prompt.

The local Workspace Owner login remains available as the recovery path. The Owner keeps a local password and cannot be converted to an external-only user.

Granting a central user access

A workspace administrator searches the configured external directory, then explicitly creates a local user or links the external identity to an eligible existing local user. Email similarity may help find a candidate, but Moltaro never links accounts automatically by email.

This is deliberately different from creating an ordinary local Workspace user under Administration > Users, where the administrator supplies an initial password in the create dialog. External provisioning may create a passwordless local profile because authentication belongs to the linked provider.

The administrator assigns local roles during or after provisioning. Removing an external link does not delete the local user, roles, or business data. Profile fields synchronized from the provider are read-only while the link is active.

Synchronization and revocation

The Worker periodically checks linked external identities and administrators can request validation or synchronization from the Authentication page. A disabled or deleted central account disables the local external link and revokes local interactive tokens issued through that link.

Authentication settings show connection health, synchronization status, safe diagnostics, directory actions, and manual validation or synchronization. Administration > Monitoring shows the same server-computed alert state, recent sanitized runs, last success, and the next scheduled check.

Self-hosted setup

The currently supported packaged topology uses Docker Compose for both Moltaro Identity and the Workspace. Windows filesystem/IIS delivery is planned but is not yet a supported SSO installation path. Portal-managed Identity deployment and Google Workspace are also not yet available.

The Identity installation creates a one-time client bundle for the Workspace. The Workspace operator applies and validates it with moltaroctl:

moltaroctl integrations identity set --install-root <workspace-root> --bundle <client-bundle>
moltaroctl integrations identity status --install-root <workspace-root>
moltaroctl integrations identity validate --install-root <workspace-root>

Applying a bundle writes secrets through the installation secret boundary, creates or replaces the active connection, restarts API and Worker, and validates discovery, signing keys, client credentials, callback addresses, directory access, and synchronization. Clearing a connection removes active credentials while preserving local users and historical audit records.

Moltaro Identity and Workspace installations are currently deployed and connected as self-hosted Docker Compose components. Automated Portal provisioning and wiring of an Identity managed application is not part of this supported workflow.