SSO (OIDC)
OIDC-based single sign-on for the Wave Web Console. Works with Okta, Microsoft Entra ID (Azure AD), Google Workspace, Keycloak, and other standards-compliant OIDC providers. Local admin survives as a break-glass path.
In short
- • Federate to any OIDC IdP — Okta, Microsoft Entra ID, Google Workspace, Keycloak.
- • Stateless: a single encrypted cookie carries the OIDC state; no Redis, no DB.
- • Pre-provisioned users (admin creates the row with auth_source=sso); roles reuse Viewer / Operator / Manager / Admin.
- • Local admin survives as a break-glass path — an IdP outage cannot lock you out.
Why better than the Kubernetes-native default
Kubernetes does not solve dashboard authentication. Console-style tools either ship without auth, depend on kubectl proxy plus your kubeconfig, or roll a single shared admin account — none of which passes a compliance review for a team. Wave SSO federates to the IdP your organization already uses, so every engineer logs in as themselves and the audit trail is real.
Setup is Helm values plus one Kubernetes Secret — no external session store, no extra services. The local admin account survives as a break-glass path, so an IdP outage cannot lock you out of the cluster.
What you get
OIDC over any compliant IdP
Authorization Code with PKCE, encrypted state cookie, configurable email claim, optional verified-email enforcement. No vendor lock-in.
Pre-provisioned users
Admins create user rows in advance with auth_source = sso and reuse the existing Viewer / Operator / Manager / Admin roles. The first IdP login binds to the matching row by email.
Break-glass local admin
Even with SSO turned on, the original local admin account stays available behind a toggle on the login page. If your IdP has an outage, you still get into the cluster.
Supported identity providers
Wave SSO follows the OpenID Connect Core 1.0 spec, so any IdP that implements Authorization Code flow with PKCE works. The IdPs we have tested against:
- • Okta
- • Microsoft Entra ID (Azure AD)
- • Google Workspace
- • Keycloak
Other standards-compliant OIDC providers (e.g. Auth0, Ping, OneLogin) are expected to work — let us know if you hit a compatibility issue.
Set up SSO in about ten minutes
The setup runbook walks through cookie key generation, IdP app registration, the WA_SSO_* env vars, user pre-provisioning, and the IdP-specific gotchas we have hit in production.
Read the SSO setup guide