About Glean SSO
Single Sign-On (SSO) is mandatory for Glean and will be the first thing configured when setting up your organization's Glean environment. Integrating your directory service with Glean automatically synchronizes user information so that your organization's document access controls are accurately reflected in search results.
SSO allows users to securely authenticate with multiple applications and websites by using just one set of credentials. This simplifies the login process for end-users, as they can navigate between services seamlessly without the need to manage multiple passwords.
Understanding Glean SSO
Glean SSO utilizes standard authentication protocols such as OpenID Connect (OIDC) and Security Assertion Markup Language (SAML) to establish a secure communication channel between Glean and an organization's identity provider (IdP). The IdP could be services like Okta, Entra ID, OneLogin, or Google.
Glean recommends the use of OIDC over SAML due to the more granular control over permissioning that it provides.
When a user attempts to access Glean, they are redirected to their IdP to authenticate. Upon successful authentication, the IdP sends a response back to Glean, which then grants the user access. Glean further ensures that the user's email domain matches the expected customer domain before issuing a login cookie.
OIDC also enables Glean to asynchronously synchronize directory information from your IdP. If you choose to implement SAML instead, you are responsible for maintaining your directory information in Glean. For a detailed comparison of the two protocols, see About OIDC & SAML.
User Access Control
All user access to Glean is controlled via your IdP.
You can choose to restrict the users that can access Glean to only those users or groups assigned to the Glean configuration within your IdP.
Glean recommends that you configure an appropriately secure conditional access or conditional authentication policy that includes the use of Multi-Factor Authentication (MFA).
Configuring SSO
Please see the articles below for detailed instructions on how to configure Glean SSO for your IdP: