SSO (OIDC) & MFA (TOTP)

Security and identity governance in DataSquares provide enterprise single sign-on (SSO) via OpenID Connect (OIDC) alongside account-level Multi-Factor Authentication (MFA) via Time-based One-Time Passwords (TOTP).

Single sign-on (OIDC)

DataSquares integrates with standard OpenID Connect identity providers, including:

• Microsoft Entra ID (Azure AD)
• Okta
• Google Workspace
• Auth0
• Keycloak / PingFederate

Configuration options

In Admin → Settings �� Single sign-on (/admin/settings):

Setting	Description
SSO enabled	Master switch activating SSO login for the workspace.
Issuer URL	The IdP’s OIDC discovery endpoint (e.g. https://login.microsoftonline.com/{tenant}/v2.0 or https://{tenant}.okta.com).
Client ID	The unique Application/Client ID generated in your IdP application registration.
Client secret	The application client secret. Write-only: leaving blank during edits preserves the existing secret.
Auto-provision email domains	Comma-separated list of approved email domains (e.g. company.com, subsidiary.com).
Auto-provision new users	When enabled, users authenticating via SSO for the first time are automatically provisioned with the default Viewer workspace role.

SSO sign-in flow

1. On the DataSquares login screen, users select Sign in with SSO.
2. Entering their email address initiates a realm lookup based on the domain suffix.
3. Users are redirected to your corporate identity provider for authentication.
4. Upon successful authentication, users are redirected back to DataSquares with an authenticated session.

Local fallback

If SSO is ever unavailable or domain routing is misconfigured, local administrator password sign-in remains operational for credentialed accounts.

Two-factor authentication (TOTP)

Multi-factor authentication (MFA) is configured per account and supports any RFC 6238 TOTP authenticator application (such as 1Password, Google Authenticator, Microsoft Authenticator, or Apple Keychain).

Setup and enrollment

1. Open the user profile avatar menu and choose Two-factor authentication.
2. Click Set up two-factor to display a cryptographically signed QR code (alongside a manual base32 setup secret).
3. Scan the code into your authenticator app.
4. Enter the 6-digit TOTP code and click Verify and enable. The factor activates only after a valid code proves successful enrollment.

Single-use recovery codes

Upon enabling TOTP, DataSquares generates 10 single-use emergency recovery codes:

• Store safely: Copy and store these codes in an offline password manager or secure vault. They provide emergency access if your authenticator device is lost or inaccessible.
• One-way hashing: Recovery codes are stored strictly as SHA-256 hashes in the database. Support and administrators cannot view or recover these codes.
• Format flexibility: Codes are hyphen- and case-insensitive when entered manually.
• Audit logging: Authenticating via a recovery code logs an immediate security audit record in the Audit Log.
• Regeneration: Users can regenerate a fresh set of 10 codes at any time from their security settings by verifying their current TOTP code.

Sign-in experience with MFA

1. Enter your primary email and password (or complete SSO sign-in).
2. Enter the current 6-digit TOTP code from your authenticator app (valid within a rolling time window).
3. Alternative: If the authenticator is unavailable, click Use a recovery code and enter one of your 10 stored recovery codes.

Related

• Users, roles & invites — user directory and role-based permissions.
• Workspace settings & operations — organization settings and API keys.
• Audit log — tracking SSO logins and recovery code activations.