Self-hosted authentication methods overview

Authentication

LightMesh self-hosted deployments support email/password, Entra ID SSO, Google SSO, and API keys. On-premises LDAP or Active Directory can be enabled with Tidal support when required.

Overview

Authentication options in LightMesh depend on how the product is deployed. SaaS customers use Tidal-hosted identity defaults, while self-hosted enterprise customers control identity configuration on their own infrastructure. In either case, the customer owns their identity data; Tidal does not hold directory credentials or customer certificates. This page describes the methods available for self-hosted deployments and when each is appropriate.

Supported authentication methods

Method SaaS Self-hosted User experience Configuration
Email / password (local) Yes Yes Register or login form In-app / standard setup
Google OAuth Optional Optional Google SSO button Tidal SaaS config or customer env
Microsoft / Entra ID SSO Optional Optional Microsoft SSO button Enterprise guide
On-premises LDAP / Active Directory No Available with Tidal support Username + password Contact Tidal; not self-serve today
API keys Yes Yes CLI / automation / MCP In-app (Admin → API Keys)

Notes:

  • SaaS deployments use Tidal-managed identity defaults. Social and SSO buttons are enabled per environment via feature flags and are not guaranteed in every SaaS tenant.
  • Self-hosted deployments configure identity via Account → Sign-in Methods (Microsoft / Azure AD) and/or server environment variables. See the Microsoft Entra ID SSO guide for step-by-step setup.
  • Microsoft customers should use Entra ID SSO. That is the current Microsoft path. Most organizations that previously used on-premises Active Directory have moved to Entra ID.
  • On-premises LDAP or Active Directory bind is something Tidal can support for self-hosted customers who still require it. It is not a current self-serve setup, and there is no separate AD-branded login. Contact Tidal if you need it.

When to use which method

Use this decision tree to choose an authentication path for a self-hosted deployment. No directory credentials, certificates, or network addresses are required to make the choice.

flowchart TD
    A["Start: how will users sign in?"] --> B{"Already using Microsoft 365 / Entra ID?"}
    B -->|Yes| C["Microsoft Entra ID SSO"]
    B -->|No| D{"Already using Google Workspace?"}
    D -->|Yes| E["Google SSO"]
    D -->|No| F{"Air-gapped or no cloud identity provider?"}
    F -->|Yes| G["Email / password"]
    F -->|No| H{"Need programmatic or CLI access?"}
    H -->|Yes| I["API keys"]
    H -->|No| J["Email / password"]

If you still require on-premises LDAP or Active Directory bind, contact Tidal. That path is available with an enterprise engagement; it is not the default Microsoft option.

API keys are managed in the LightMesh UI and used with the LightMesh CLI or direct API calls.

Prerequisites at a business level

Before integrating a self-hosted LightMesh instance with a corporate identity provider, confirm the following at a business level:

  • A service account with read access to the directory or identity provider.
  • A registered application in your identity provider for LightMesh to trust.
  • Network reachability between the LightMesh server and your identity provider or directory service.

Microsoft Entra ID SSO

Microsoft Entra ID SSO lets users sign in to LightMesh with their existing Microsoft work or school credentials. LightMesh delegates authentication to your Entra ID tenant and receives signed identity claims, so it never sees user passwords.

Self-hosted deployments can use a client secret or a certificate. Configure Azure in the Entra portal, then enable LightMesh in Account → Sign-in Methods or with environment variables.

Microsoft Entra ID SSO setup guide →

API keys and CLI authentication

API keys provide programmatic access to LightMesh for scripts, CLI tooling, and integrations. They are created in-app and are the recommended way to authenticate automation that does not use interactive SSO.

For setup details, see the LightMesh CLI installation guide and the API key training material.

SaaS login options

If you are using Tidal-hosted LightMesh rather than a self-hosted deployment, see the Getting Started signup section for the available login and registration options.

SaaS users can self-manage linked Google, Microsoft, Okta, and email/password methods from Account → Sign-in Methods. See Sign-in Methods for the end-user guide.

Self-hosted deployments also use Account → Sign-in Methods for organization-wide Microsoft / Azure AD setup (secret or certificate). Personal Google/Microsoft linking and Okta SSO remain SaaS-oriented; see the Entra ID SSO guide for self-hosted Microsoft login.

Enterprise setup

For LDAP / Active Directory bind or other identity paths that are not self-serve, Tidal provides enterprise onboarding support. For Entra ID SSO, use the public setup guide.

For more information, contact Tidal.

FAQ

Is on-premises LDAP or Active Directory supported?

Yes, with Tidal support on self-hosted deployments. It is not a current self-serve setup. Prefer Entra ID SSO if your organization already uses Microsoft 365. Contact Tidal if you still need on-premises directory bind.

Is SAML / AD FS supported?

No. SAML and Active Directory Federation Services are not native LightMesh login providers today.

Can I sync Active Directory groups to LightMesh roles?

No. Automated AD group-to-role sync is not available.

Is SCIM provisioning supported?

Not currently. User accounts must be created or invited through the LightMesh UI or API.

Is Kerberos / SPNEGO supported?

No. Integrated Windows authentication via Kerberos or SPNEGO is not supported.

Previous
Next