Single sign-on

GantryCD has no local accounts. Every user signs in through an identity provider, and their first sign-in provisions their account. GantryCD supports three kinds of provider, all feeding the same identity and access machinery.

One callback for everything

Every provider uses a single redirect URI:

{GANTRYCD_BACKEND_PUBLIC_BASE_URL}/api/v1/auth/sso/callback

Register that exact URL with each IdP. GantryCD routes the callback to the right provider internally — you never register a per-provider path.

From claims to access

A provider only authenticates who you are. Access comes from rules (for org membership) and group bindings (for roles — see Access control). Each provider page lists the rule shapes it supports; the catalogue:

{"type": "github_org",  "org": "acme"}
{"type": "github_team", "org": "acme", "team": "platform"}
{"type": "google_hd",   "domains": ["acme.com", "acme-eu.com"]}
{"type": "oidc_group",  "group": "engineers"}

Internals

Bootstrap/recovery, per-tenant isolation, and the (provider_key, issuer, subject) identity model are in SSO Configuration.