Self-hosted authentication methods overview

Authentication

LightMesh self-hosted deployments support email/password, Entra ID SSO, Google SSO, and API keys. On-premises LDAP or Active Directory can be enabled with Tidal support when required.

Overview

Authentication options in LightMesh depend on how the product is deployed. SaaS customers use Tidal-hosted identity defaults, while self-hosted enterprise customers control identity configuration on their own infrastructure. In either case, the customer owns their identity data; Tidal does not hold directory credentials or customer certificates. This page describes the methods available for self-hosted deployments and when each is appropriate.

Supported authentication methods

Method SaaS Self-hosted User experience Configuration
Email / password (local) Yes Yes Register or login form In-app / standard setup
Google OAuth Optional Optional Google SSO button Tidal SaaS config or customer env
Microsoft / Entra ID SSO Optional Optional Microsoft SSO button Enterprise guide
On-premises LDAP / Active Directory No Available with Tidal support Username + password Contact Tidal; not self-serve today
API keys Yes Yes CLI / automation / MCP In-app (Admin → API Keys)

Notes:

  • SaaS deployments use Tidal-managed identity defaults. Social and SSO buttons are enabled per environment via feature flags and are not guaranteed in every SaaS tenant.
  • Self-hosted deployments configure identity via server settings at install time. Operators receive the enterprise guide from Tidal during onboarding.
  • Microsoft customers should use Entra ID SSO. That is the current Microsoft path. Most organizations that previously used on-premises Active Directory have moved to Entra ID.
  • On-premises LDAP or Active Directory bind is something Tidal can support for self-hosted customers who still require it. It is not a current self-serve setup, and there is no separate AD-branded login. Contact Tidal if you need it.
  • This public page describes what is available at a high level. Operational setup details are provided in the enterprise deployment guide.

When to use which method

Use this decision tree to choose an authentication path for a self-hosted deployment. No directory credentials, certificates, or network addresses are required to make the choice.

flowchart TD
    A["Start: how will users sign in?"] --> B{"Already using Microsoft 365 / Entra ID?"}
    B -->|Yes| C["Microsoft Entra ID SSO"]
    B -->|No| D{"Already using Google Workspace?"}
    D -->|Yes| E["Google SSO"]
    D -->|No| F{"Air-gapped or no cloud identity provider?"}
    F -->|Yes| G["Email / password"]
    F -->|No| H{"Need programmatic or CLI access?"}
    H -->|Yes| I["API keys"]
    H -->|No| J["Email / password"]

If you still require on-premises LDAP or Active Directory bind, contact Tidal. That path is available with an enterprise engagement; it is not the default Microsoft option.

API keys are managed in the LightMesh UI and used with the LightMesh CLI or direct API calls.

Prerequisites at a business level

Before integrating a self-hosted LightMesh instance with a corporate identity provider, confirm the following at a business level:

  • A service account with read access to the directory or identity provider.
  • A registered application in your identity provider for LightMesh to trust.
  • Network reachability between the LightMesh server and your identity provider or directory service.

Microsoft Entra ID SSO

Microsoft Entra ID SSO lets users sign in to LightMesh with their existing Microsoft work or school credentials. LightMesh delegates authentication to your Entra ID tenant and receives signed identity claims, so it never sees user passwords.

For self-hosted deployments, Entra ID SSO can use certificate-based trust — LightMesh proves its identity to Microsoft with an X.509 certificate rather than a shared secret, which is easier to rotate and audit. The certificate lifecycle, Graph API permissions, and federation settings are covered in the enterprise deployment guide.

API keys and CLI authentication

API keys provide programmatic access to LightMesh for scripts, CLI tooling, and integrations. They are created in-app and are the recommended way to authenticate automation that does not use interactive SSO.

For setup details, see the LightMesh CLI installation guide and the API key training material.

SaaS login options

If you are using Tidal-hosted LightMesh rather than a self-hosted deployment, see the Getting Started signup section for the available login and registration options.

Enterprise setup

Self-hosted authentication integrations are delivered as part of the LightMesh enterprise onboarding package. Tidal provides the deployment guide, templates, and hands-on support needed to connect your identity provider securely.

For more information, contact Tidal.

FAQ

Is on-premises LDAP or Active Directory supported?

Yes, with Tidal support on self-hosted deployments. It is not a current self-serve setup. Prefer Entra ID SSO if your organization already uses Microsoft 365. Contact Tidal if you still need on-premises directory bind.

Is SAML / AD FS supported?

No. SAML and Active Directory Federation Services are not native LightMesh login providers today.

Can I sync Active Directory groups to LightMesh roles?

No. Automated AD group-to-role sync is not available.

Is SCIM provisioning supported?

Not currently. User accounts must be created or invited through the LightMesh UI or API.

Is Kerberos / SPNEGO supported?

No. Integrated Windows authentication via Kerberos or SPNEGO is not supported.

Next