LakeSentry SSO Setup for Okta, Entra ID, Google, and JumpCloud

This page walks through the identity-provider side of LakeSentry SSO for each supported provider. Before you start, open Settings > SSO in LakeSentry and copy the read-only Redirect URI — every guide below registers it in the IdP, and it must match exactly.

Whichever provider you use, the LakeSentry side is the same: pick the provider preset, paste the issuer URL, client ID, and client secret, run Test configuration, save, and enable the toggle. See Enabling SSO.

Okta

Create the app in the Okta Admin Console:

1. Go to Applications > Applications > Create App Integration.
2. Choose OIDC - OpenID Connect as the sign-in method and Web Application as the application type.
3. Name the app (e.g. LakeSentry), keep the Authorization Code grant, and set Sign-in redirect URIs to the LakeSentry redirect URI.
4. Under Assignments, choose who can use the app — a selected group or everyone in the organization. Unassigned users are blocked by Okta before they reach LakeSentry. Save.
5. On the app’s General tab, copy the Client ID and Client secret, and confirm Client authentication is set to Client secret.

Then check the authorization server under Security > API > Authorization Servers > default:

• Scopes — email and profile must exist (they do by default).
• Access Policies — a policy must be assigned to your app (or “All clients”) with a rule allowing the Authorization Code grant for assigned users. If the default policy is missing or scoped to other clients, token requests fail even though Test configuration passes.

Values for LakeSentry:

Field	Value
Provider	Okta
Issuer URL	https://<your-org>.okta.com/oauth2/default (your authorization server issuer)
Client ID / secret	From step 5

Note

Okta’s default authorization server may omit the email_verified claim from ID tokens. LakeSentry then verifies the email through Okta’s userinfo endpoint automatically — no extra configuration needed.

Microsoft Entra ID

Create the app registration in the Microsoft Entra admin center:

1. Go to Microsoft Entra ID > App registrations > New registration.
2. Name the app, choose Single tenant (“Accounts in this organizational directory only”), and add the LakeSentry redirect URI on the Web platform. Register.
3. From the Overview blade, record the Application (client) ID and the Directory (tenant) ID.
4. Under Certificates & secrets, create a client secret and copy its Value immediately (not the Secret ID) — it is shown once.
5. Under API permissions, confirm Microsoft Graph → Delegated includes openid, email, and profile (present by default).
6. Under Token configuration, add the optional email claim for ID tokens. Entra v2.0 ID tokens don’t always emit email; LakeSentry falls back to preferred_username/upn, but UPN is not a mailbox for guest users.
7. Assign users: Enterprise applications > your app > Users and groups. With Assignment required = Yes, unassigned users are blocked by Azure before they reach LakeSentry.

Values for LakeSentry:

Field	Value
Provider	Microsoft Entra ID
Issuer URL	https://login.microsoftonline.com/<directory-tenant-id>/v2.0
Client ID	Application (client) ID from step 3
Client secret	Secret value from step 4

The issuer must be your tenant-specific URL — multi-tenant issuers (/common/, /organizations/, /consumers/) are rejected, and users must sign in from that same tenant.

Note

Entra ID tokens carry no email_verified claim, and LakeSentry does not assume Entra emails are verified. First-time Entra users therefore arrive as access requests even under auto-approve or with a pending invitation. Approve them once; every later sign-in is seamless.

Google

Create OAuth credentials in the Google Cloud console:

1. In APIs & Services > OAuth consent screen, configure the consent screen if you haven’t. For a Google Workspace organization, choose the Internal user type so only your users can sign in.
2. In APIs & Services > Credentials, click Create credentials > OAuth client ID, choose Web application, and add the LakeSentry redirect URI under Authorized redirect URIs.
3. Copy the generated Client ID and Client secret.

Values for LakeSentry:

Field	Value
Provider	Google
Issuer URL	https://accounts.google.com (exactly — LakeSentry validates it)
Client ID / secret	From step 3

Google reports verified emails, so auto-approve and invitation acceptance work out of the box. Consider setting Allowed domains to your Workspace domain so personal Google accounts can’t request access.

JumpCloud

LakeSentry has no JumpCloud preset, so JumpCloud is configured as Generic OIDC with a custom application on the JumpCloud side.

In the JumpCloud Admin Console, go to SSO Applications > Add New Application > Custom Application, check Manage Single Sign-On (SSO), and choose Configure SSO with OIDC. Then, on the SSO tab:

1. Set Grant Type to Authorization Code and Redirect URIs to the LakeSentry redirect URI.
2. Set Client Authentication Type to Client Secret Post (not Basic) — LakeSentry sends credentials in the token request body.
3. Set Login URL to https://<tenant-host>.
4. Under Attribute Mapping, check the Email and Profile standard scopes and map the user attribute email → email.
5. Add a Constant Attribute: email_verified = true. Without it, JumpCloud logins can’t auto-accept invitations or auto-approve.
6. Click Activate at the bottom (the badge must read “Single Sign-On Active”), then copy the Client ID and Client Secret — the secret is shown once.
7. On the User Groups tab, bind the group(s) that should have access and Save. Each user needs an active password in JumpCloud and a usable email.

Values for LakeSentry:

Field	Value
Provider	Generic OIDC
Display name	JumpCloud (or your label — it appears on the login button)
Issuer URL	https://oauth.id.jumpcloud.com
Client ID / secret	From step 6

After the provider is connected

• Set the SSO Access Policy on Settings > Access — require approval (default) or auto-approve as user.
• Read What changes at login before enabling SSO on a shared tenant: admins and users lose password login, and the owner keeps a fallback at /admin/login.