Authentication

Authentication connects SEI to an external identity provider so users can sign in with their existing organizational credentials instead of managing a separate password. Two protocols are supported: OAuth 2.0 and SAML 2.0. Both work by registering SEI with your identity provider, which then handles credential verification and returns a confirmed identity back to SEI.

Before configuring a provider, make sure SEI has already been registered with your identity provider. This registration produces the credentials and endpoints you will need to fill in below.

Once a provider is configured, enable Login Settings to make it available on the login page. You can configure more than one provider if needed.

Protocol	What it does
OAuth 2.0	Authenticates users through an external identity provider using token-based access. Widely supported by providers like Microsoft, Google, and Okta.
SAML 2.0	Authenticates users through identity providers such as Microsoft Azure, Okta, and OneLogin using XML-based assertions. Common in enterprise environments.

Add a provider

important

Every SEI user must be mapped to the provider with a correct User Identifier value. A user who is not mapped, or whose identifier does not match what the provider returns, will not be able to sign in.

1. In the navigation panel, select the gear icon to open the Administration section.
2. Select Security, then Authentication.
3. Select the + icon to add a provider.
4. Choose between OAuth2 and SAML2.
5. Select Create. A configuration form opens in the right panel.
6. Under the General tab, fill in the required fields.
7. Select Save.
8. Open the Users tab, select the + icon, and map SEI users to the provider.
9. Select all applicable users and select Add. The selected users appear in the Users list.
10. Select Save.

General tab

The fields in this tab depend on the provider you selected.

OAuth 2.0

OAuth 2.0

For a full configuration walkthrough, see the OAuth 2.0 Configuration Example.

Field	What to enter
Activate	Toggle on to make this provider available on the login page. When active, a sign-in button for this provider appears under External Accounts.
Description	Label displayed on the login page button for this provider. Replace the default New Provider with a name users will recognize, such as Sign in with Microsoft.
Client ID	Public identifier assigned to SEI when you registered it with your identity provider. Find this in your provider's app registration settings.
Client Secret	Private secret assigned alongside the Client ID. It is hidden after saving and must be re-entered if you need to update it.
Discovery Endpoint	Optional Metadata URL provided by your identity provider, usually ending in /.well-known/openid-configuration. Entering it and selecting Discover auto-fills the Authorization, Token, and User Info endpoints and loads available scopes and claims. Use this to avoid filling in each endpoint manually.
Authorization Endpoint	URL where users are sent to authenticate, typically ending in /authorize.
Token Endpoint	URL to exchange an authorization code for an access token, typically ending in /token.
Scope	Permission scopes requested from the identity provider for the web server. Common values are openid, email, and offline_access, but the required scopes depend on your provider.
Redirect URLs	URLs the identity provider sends users back to after a successful login. Enter the URL for the Web Server (SEI) and, if applicable, for the Excel Add-in. For the Excel Add-in, the URL must include the correct local port.
User Info Endpoint	URL to retrieve the authenticated user's profile information, typically ending in /userinfo.
User Identifier	Claim from the identity provider used to match the authenticated user to a SEI account. In multitenant environments, use a stable claim such as sub or oid that doesn't change over time. For example, if your provider returns "sub": "bf38b88a-5c16-4f58-bf5a-87ccd8e5ad09", enter that value in the Users tab for the corresponding user.
Prompt	Controls what the identity provider shows users at login. login always displays the sign-in window. consent asks users to approve permissions on every login. select_account shows a list of previously used accounts. none skips prompts entirely if the user is already authenticated. This setting does not affect security, only the login experience.
Force reauthentication	When enabled, users must re-enter their credentials after a defined period. Enter the delay in seconds. A value of 0 requires credentials on every login. A value of 21600 requires them every 6 hours. Maximum is 86400 seconds (24 hours). Not all providers support this setting.
Allow remember me	When enabled, the browser remembers the authentication session and keeps users signed in across sessions.

SAML 2.0

SAML 2.0

For a full configuration walkthrough, see the SAML 2.0 Configuration Example.

Field	What to enter
Activate	Toggle on to make this provider available on the login page. When active, a sign-in button for this provider appears under External Accounts.
Description	Label displayed on the login page button for this provider. Replace the default New Provider with a name users will recognize, such as Sign in with Azure.
Discovery Endpoint	Optional Metadata URL provided by your SAML 2.0 identity provider. Selecting Discover auto-fills the Provider Entity ID, Provider Login Endpoint, and Provider Logout Endpoint. Use this to avoid filling in each field manually.
Entity ID	Unique identifier for SEI. Must match exactly the Identifier (Entity ID) or Audience URI configured in Azure, Okta, or your provider.
Provider Entity ID	Identifier your SAML 2.0 provider uses for the application. Must match the Azure App ID URI or Okta Identity Provider Issuer.
Provider Login Endpoint	URL SEI sends authentication requests to. Provided by your SAML 2.0 provider and must match the endpoint configured there.
Provider Logout Endpoint	Optional When filled in, signing out of SEI also signs the user out of the SAML 2.0 provider session. If left empty, only the SEI session ends.
SAML 2.0 ACS URL	URL the identity provider sends the SAML response to after a successful login. Must match the Reply URL or Assertion Consumer Service URL configured in your provider. Auto-filled for the web server and for the Excel Add-in, specify the correct local port.
Logout URL	Optional URL users are redirected to after signing out of SEI. Unlike Provider Logout Endpoint, this does not end the SAML 2.0 provider session.
Certificate	SAML 2.0 signing certificate from your identity provider. Must use SHA-256. Drag and drop the file downloaded from Azure or Okta. This certificate lets SEI verify that SAML responses are genuinely from your provider.
User Identifier	Claim from the SAML 2.0 response used to match the authenticated user to a SEI account. For security purposes, use a stable claim like sub or oid in multitenant environments. This value must match what you enter in the User Identifier field in the Users tab.
Force reauthentication	When enabled, users must re-enter their credentials after a defined period. Enter the delay in seconds. A value of 0 requires credentials on every login. A value of 21600 requires them every 6 hours. Maximum is 86400 seconds (24 hours). Not all providers support this setting.
Allow remember me	When enabled, the browser remembers the authentication session and keeps users signed in across sessions.

Users tab

It lists the SEI users mapped to this authentication provider. Each user's identity is verified against the provider using the User Identifier value set in the General tab.

Field	What it shows
Username	SEI username used to sign in.
Name	Display name associated with the username.
Email	Email address associated with the user account.
User Identifier	Value returned by the provider for the identifier claim selected in the General tab. This is how SEI matches the external identity to this user. For example, if the User Identifier claim is sub and your provider returns "sub": "bf38b88a-5c16-4f58-bf5a-87ccd8e5ad09", enter that value for the corresponding user.