Authentication

How users sign in to e6data - local accounts, single sign-on, and TLS.

e6data supports multiple authentication methods. Most production tenants use SSO via an identity provider; local accounts are also available.

Method

Use case

Local accounts

Default for new tenants; users sign in with email + a one-time passcode (OTP) sent to their inbox

Single Sign-On (SSO)

Recommended for organizations with an existing IdP

Service Token

Programmatic access - REST API

In this section

Single sign-on - supported IdPs and setup guides
Domain auto-join and JIT provisioning - auto-join by email domain and provision SSO users on first sign-in
TLS certificates - endpoint certificate management

For any tenant with more than a few users, configure SSO. It:

Centralizes user lifecycle in your IdP - a user deactivated there can no longer sign in or refresh tokens; existing sessions stay valid until they expire (refresh-token TTL defaults to 24 hours)
Captures your IdP's group claims at sign-in - e6data roles are still assigned in access-control settings, not auto-mapped from IdP groups
Integrates with your existing MFA, conditional access, and compliance policies

See Single sign-on for supported providers.

Concept

What it controls

Authentication (this section)

Who you are - proves identity at sign-in

Authorization (Access control)

What you can do - controls actions after sign-in

Both work together: authentication establishes identity; access control determines what that identity can read, edit, or run.