Security Settings
Account and workspace security settings that are available in the current Leenops app.
Leenops separates personal account security from workspace-level enterprise controls. Personal profile and password settings live under Settings > Profile and authentication pages. Workspace security controls live under Settings > Security and require a workspace admin or owner role.
What admins can configure
| Control | App location | Current behavior |
|---|---|---|
| SAML SSO | Settings > Security > SAML SSO | Upload IdP metadata XML, review SP URLs, enable or delete the workspace SAML configuration. |
| SCIM 2.0 | Settings > Security > SCIM 2.0 Provisioning | Generate one-time-visible Bearer tokens, copy the SCIM base URL, review token prefixes and last-used timestamps, revoke tokens. |
| Domain control | Settings > Security > Domain control | Claim an email domain, publish a DNS TXT verification record, verify the claim, delete stale claims. |
| IP allowlist | Settings > Security > IP allowlist | Add IPv4/IPv6 CIDR ranges, enable allowlist enforcement, and require email login OTP for password sign-ins. |
Each admin API is protected by the workspace-admin guard. The caller must present a valid session token and be an admin or owner in the target workspace. SAML configuration changes and SCIM token creation/revocation also require a recent step-up verification.
SAML SSO
The SAML page shows the Leenops service-provider values to copy into your identity provider:
- SP Entity ID / metadata URL
- Assertion Consumer Service URL
- Workspace login URL
Paste your IdP metadata XML into the page. Leenops parses the IdP entity ID, SSO URL, and certificate from that XML. The SSO toggle is disabled until a certificate has been saved.
Runtime behavior:
- The SAML ACS endpoint validates signed responses with
xml-crypto. - Responses must match the login request, audience, destination, recipient, and IdP issuer.
- Expired assertions are rejected.
- New SAML users are provisioned into the workspace as
member. - SAML login success and failure events are written to the audit log.
SCIM provisioning
Use the SCIM page to generate a token for your identity provider. The raw token is shown once. Leenops stores only the hash and a prefix.
Use this base URL format in your IdP:
https://workspace.leenops.com/api/scim/v2/{workspace_id}Supported SCIM surfaces include Users, Groups, Schemas, ResourceTypes, and ServiceProviderConfig. SCIM requests authenticate with Authorization: Bearer {token} and are rate-limited by token after successful authentication.
Domain control
Domain claims use DNS TXT verification. After starting a claim, publish this value at the claimed domain:
leenops-domain-verify={verification_token}Leenops refuses domains that are already verified for another workspace. The verify action resolves TXT records and marks the claim verified only when the expected value is present.
IP allowlist and login OTP
IP allowlist entries accept IPv4 or IPv6 CIDR notation such as:
192.0.2.0/24
2001:db8::/32When Enforce allowlist is on, the session gate checks the caller IP against the workspace allowlist. An enforced policy with no entries fails closed, so add and verify at least one trusted CIDR before enabling enforcement.
When Require login OTP is on, password sign-ins for users in the workspace require a six-digit email verification code. Codes are hashed at rest, expire after 10 minutes, and allow up to five attempts.
Sessions and step-up
Leenops records per-session OTP and step-up verification state in auth_session_verifications. Sensitive admin actions can require a recent step-up check. If the current Supabase assurance level is already aal2, the action may continue; otherwise Leenops checks for a recent session-level step-up record.
Current public docs should not promise an admin-visible active-session management screen unless one is added to the app. Platform operators can revoke sessions from internal console tooling, and self-service account deletion revokes the deleting user's sessions.