SSO / Identity Provider
Blocks Enterprise supports OIDC (OpenID Connect) single sign-on with automatic group synchronization.
Overview
Users authenticate with your corporate identity provider instead of separate Blocks credentials. Identity provider groups automatically map to Blocks organizations.
Blocks Enterprise uses OIDC (OpenID Connect / OAuth 2.0) protocol. Okta is the tested and documented provider. Other OIDC-compliant providers (Azure AD, Google Workspace, Auth0, etc.) are expected to work but should be validated with enterprise@blocks.ai before deployment.
Setup
Prerequisites:
- Enterprise administrator access
- OIDC application configured in your identity provider
Required from your IdP:
- Issuer URL
- Client ID
- Client Secret
- Redirect URI (configure in IdP):
https://your-company.blocks.ai/api/auth/oauth2/callback/oidc/
Configuration:
After configuring your OIDC application in your identity provider, enterprise administrators complete the setup in the Admin Console by providing identity provider connection details, optional custom button label, group claim configuration (for group sync), and connection status (active/disabled/removed).
Email/password authentication remains available as fallback for enterprise administrators.
Group synchronization
How it works:
- User logs in via SSO
- Identity provider sends group memberships in OIDC token
- Admin-configured mappings translate IdP groups to Blocks organizations
- User automatically added to/removed from organizations based on current groups
Default permissions: agent:submit-task and agent:manage
Reconciliation rules:
- Users added to organizations matching their IdP groups
- Users removed from organizations only if membership was created by SSO and they lost the group
- Manually granted memberships preserved
- Users always remain in default organization
Group matching: Case-insensitive (e.g., Engineering matches engineering)