Dify Enterprise SSO with Okta (OIDC or SAML)
Configuring Okta for Dify Enterprise workspace and web app sign-in: choosing OIDC or SAML, the separate callback URLs for each scope, and the session timeout.
Dify SSO and access control
Identity and access specifics for Dify: Enterprise SSO with named identity providers, SCIM provisioning, custom roles, web app access levels and external users, plus Community login options.
Dify Enterprise SSO with Microsoft Entra ID
Setting up Entra ID SAML sign-in for Dify Enterprise, and why Entra blocks SSO pages inside iframes, which affects embedded web apps.
Dify Enterprise SSO with Keycloak
Using a self-hosted Keycloak as Dify Enterprise's identity provider through standard OIDC or SAML, keeping the whole sign-in path inside your own infrastructure.
Dify Enterprise SSO with GitHub OAuth2
When GitHub sign-in fits a developer-facing Dify Enterprise deployment, how the OAuth2 app is registered, and its limits compared with an enterprise identity provider.
Dify SCIM provisioning with Okta or Entra ID
Syncing users and groups into Dify Enterprise with SCIM 2.0: the base URL and one-time bearer token, Okta and Entra setup, and deprovisioning leavers.
Dify Enterprise custom roles and permission templates
Designing workspace roles and resource permission sets for new workspaces, per-app exceptions, and separating who builds, deploys and grants access to apps.
Dify web app access control levels
Choosing who can use each published web app: specific members or groups by default, all platform members, authenticated external users or public, and the permission needed to change it.
Dify web apps for external users through SSO
Opening Dify web apps to customers, partners or staff without Dify accounts through a separate identity provider, with external users kept apart from workspace data.
Dify MCP user identity forwarding
Passing the signed-in user's identity provider token to downstream MCP servers so tools can authorize and audit per user instead of trusting one workspace credential.
Dify Community edition login options without SSO
What a Community instance can do for sign-in without Enterprise SSO: email and password, one-time email codes, GitHub and Google OAuth buttons, invite-only settings, and putting a reverse proxy authentication layer in front.
Dify Enterprise admin two-factor and password policy
Protecting the Enterprise admin console with TOTP two-factor verification, backup codes and a password policy with complexity and expiry rules that cannot be weakened below defaults.
