Sign-in and domains

Admin → Sign-in

Why it matters

Lucy has no passwords of its own. People sign in through your identity provider (IdP), so joiners, movers and leavers are handled where you already manage them: your MFA, your conditional access, your offboarding. Setup takes about 15 minutes and needs someone who can register an application at your provider.

The four parts

Part	What it is
Identity provider	Microsoft Entra ID, Google Workspace, or any OpenID Connect provider (Okta, Keycloak, Authentik and others)
Email domains	The domains your people use, each proven with a DNS record
Test sign-in	A real trial login that must pass before you can enforce
Enforce	Members can sign in only through the provider

The order is always the same: register Lucy at your provider, enter its details in Lucy, claim your domain, test, then enforce.

Step 1: register Lucy at your provider

Lucy shows the redirect URI to register. It is the same for every provider and has a copy button next to it:

https://id.asklucy.eu/idps/callback

Pick your provider below. Each tab lists what to do at the provider and which values to copy back into Lucy.

Entra ID

Official guides: Register an application · Find your tenant ID · Grant admin consent

1. In the Entra admin center, open App registrations → New registration. Name it “Ask Lucy”.
2. Under Supported account types, choose this organizational directory only unless you deliberately want any work or school account.
3. Set the Redirect URI platform to Web and paste Lucy’s redirect URI. Register.
4. Open Certificates & secrets → New client secret. Copy the secret Value straight away (not the Secret ID), and note its expiry date.
5. Open API permissions → Add a permission → Microsoft Graph → Delegated and add openid, profile, email and User.Read. Then choose Grant admin consent so nobody is asked at sign-in.
6. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.

In Lucy	Copy from Entra
Client ID	Application (client) ID
Client secret	The secret Value from step 4
Directory (tenant) ID	Directory (tenant) ID. Leave it empty to allow any work or school account
Name on the sign-in page	Optional, for example “Contoso”

Caution

A client secret expires (Entra lets you choose 6, 12 or 24 months). Put the expiry date in your calendar. When it passes, sign-in stops until you create a new secret and save it in Lucy.

Google

Official guides: Setting up OAuth 2.0 · Google’s OpenID Connect documentation

1. In the Google Cloud console, pick (or create) a project and open APIs & Services → OAuth consent screen. For a Workspace organisation choose the Internal user type, so only people of your domain can sign in.
2. Make sure the scopes openid, profile and email are allowed. These are the basic sign-in scopes.
3. Open Credentials → Create credentials → OAuth client ID and choose Web application.
4. Under Authorized redirect URIs, paste Lucy’s redirect URI. Create.
5. Copy the Client ID and Client secret that Google shows.

In Lucy	Copy from Google
Client ID	Client ID
Client secret	Client secret
Name on the sign-in page	Optional, for example “Contoso Google”

Tip

The Internal consent type is what limits sign-in to your Workspace domain. If your project is External, anyone with a Google account could try to sign in at Google’s side, so Lucy’s verified domains remain your safeguard.

Other OIDC

Any provider that speaks OpenID Connect works. Register a confidential web client that uses the authorization code flow, with the scopes openid, profile and email.

Official guides: Okta: create an OIDC app integration · Okta: authorization code flow · Keycloak: OIDC clients · Authentik: OAuth2 provider · OpenID Connect discovery

Okta

1. Applications → Create App Integration, choose OIDC and Web Application.
2. Grant type Authorization Code. Paste Lucy’s redirect URI as the Sign-in redirect URI.
3. Under Assignments, assign the people or groups who may use Lucy.
4. Copy the Client ID and Client secret.
5. Issuer URL: your Okta address, for example https://acme.okta.com. If you use a custom authorization server, use its issuer, for example https://acme.okta.com/oauth2/default.

Keycloak

1. In your realm, Clients → Create client, type OpenID Connect.
2. Switch Client authentication on and keep Standard flow enabled.
3. Add Lucy’s redirect URI under Valid redirect URIs.
4. On the Credentials tab, copy the Client secret. The Client ID is the one you chose.
5. Issuer URL: https://<your-host>/realms/<your-realm>.

Authentik

1. Applications → Providers → Create, type OAuth2/OpenID Provider.
2. Set Client type to Confidential, and add Lucy’s redirect URI (strict match).
3. Make sure the scopes openid, profile and email are selected.
4. Create an Application that uses the provider, and bind the groups who may use it.
5. Copy the Client ID and Client secret. Issuer URL: https://<your-host>/application/o/<application-slug>/.

In Lucy	Copy from your provider
Client ID and Client secret	The confidential client you created
Issuer URL	The address in the provider’s discovery document, which ends in /.well-known/openid-configuration once you add it to the issuer
Name on the sign-in page	Optional

Tip

To check the issuer, open <issuer>/.well-known/openid-configuration in a browser. It should return JSON whose issuer value matches what you enter in Lucy exactly, including any trailing path.

Select Set up to save. The client secret goes straight to Lucy’s identity service as you save, and Lucy never keeps or shows it afterwards.

Step 2: claim your email domains

1. Enter your domain, for example acme.lu, and choose Claim domain.
2. Lucy shows a DNS TXT record: the name is _asklucy-challenge.<your domain> and the value starts with asklucy-domain-verification=. Copy both with the copy buttons.
3. Add the record at your DNS host, wait a few minutes for it to propagate, then choose Verify.
4. Repeat for every domain your people use.

This proves you own the domain, so nobody else can claim your people. Once a domain is verified, anyone who types an address on it is sent straight to your provider, and gets a Lucy account on first sign-in.

Step 3: test

Choose Test next to your provider. Lucy opens a real sign-in at your provider in a window. Sign in with your own account. The result, passed or failed, is shown with the account that signed in, or a one line reason if it failed.

Step 4: enforce (optional, recommended)

The switch Members sign in only through the provider becomes available once a provider, a verified domain and a passed test all exist. With it on, every other door is closed.

Caution

Before you enforce, keep a second admin who can sign in through the provider, and run the test with an account that is not your only admin. A provider misconfiguration cannot then lock everyone out.

Checklist

• Redirect URI registered exactly as shown
• Client ID and secret saved, secret expiry in your calendar
• At least one domain verified
• Test sign-in passed
• A second admin can sign in
• Enforce switched on

Security notes

• The provider’s secret is stored in the identity service and never shown or kept by Lucy after you enter it.
• Enforce closes every other door: with it on, a leaked or guessed local login cannot be used.
• Your own MFA and conditional access policies apply, because the sign-in happens at your provider.
• Groups from your provider can be used for limits, model access and feature grants.
• New members who join through the provider are recorded in the audit log.
• Remove people in your provider and in Lucy: removing them at the provider stops sign-in, removing them in Lucy deletes their data. See Members.

Examples

A bank on Entra ID, moving fast

Situation: 400 staff, Microsoft 365 everywhere, a compliance team that wants single sign-on before anyone uses Lucy. Setup: Register the app in Entra with your tenant ID, claim bank.lu, test with a non-admin account, enforce. Result: People type their work address and land at Microsoft, with the MFA and conditional access you already run. No Lucy password exists.

A fund administrator on Okta

Situation: Okta is the single source of identity; leavers are removed there within the hour. Setup: Create an OIDC web app in Okta, assign the groups allowed to use Lucy, enter the Okta issuer URL, claim the domain, enforce. Result: Removing someone from the Okta group stops their sign-in the same day. Remove them in Lucy too to delete their data.

A group with two domains

Situation: The group trades under acme.lu and acme.eu. Setup: Claim both domains with their own DNS records. One provider serves both. Result: Anyone with either address is sent to the same provider, and gets an account on first sign-in.