Single sign-on, SCIM and keeping access tight

Let people sign in with your identity provider, add and remove them with SCIM, limit access to your networks, see who is signed in and keep the audit log.

What you’ll learn

How to turn on single sign-on with OpenID Connect or SAML, and test it safely.
How SCIM adds people when they join and removes them when they leave.
How to limit access to your offices and VPN without locking yourself out.
How to see who is signed in, sign people out and download the audit log.

Who does what

Settings › Security belongs to the Org Owner, who changes single sign-on, SCIM and the IP allow-list. Admins can look, sign members out and download the audit log.

Single sign-on

Example: Acme Logistics uses Microsoft Entra ID. Kofi, the Org Owner, wants everyone to sign in with their Acme account.

In Entra ID, Kofi registers a web application with the redirect address shown in Settings › Security (…/sso/acme-logistics/callback) and creates a client secret.
In Livra he chooses OpenID Connect, enters the email domain acmelogistics.com, the Issuer (https://login.microsoftonline.com/<tenant-id>/v2.0), the Client ID and the Client secret, and saves.
He clicks Try it in a private window and signs in as a colleague.
Once it works, he ticks Require single sign-on.

People now choose Sign in with SSO and type their work email. Members can no longer use a password, Google or GitLab — but Kofi keeps his password, so if Entra ID has a bad day, he can still get in and turn it off.

With SAML 2.0 it's the same idea: give your provider the reply address (ACS) and entity ID shown on the page (or the metadata link), then paste its sign-in address and signing certificate.

Tip: leave Create accounts on first sign-in on while people move over, so nobody has to be invited by hand. Turn it off once SCIM manages your people.

Two-step verification for everyone

Under Two-step verification, Kofi (who uses it himself already) ticks Require two-step verification and gives people 7 days. Everyone without it is told, and sees a banner until the date. After it, they can only set it up — every other page sends them there. Members signing in through Entra ID aren't asked again if Not for single sign-on stays ticked.

SCIM: joiners and leavers

Click Turn on and make a token, and copy it — it's shown once.
In your identity provider's provisioning, enter the SCIM base address (…/scim/v2) and the token.
Assign the people or groups who should have Livra.

When someone joins, they appear as a member. When someone leaves and is removed in the identity provider, their account is disabled and signed out at once; their features and history stay. Roles stay in Livra, and SCIM never touches the Org Owner.

Your networks only

Under IP allow-list, list your office and VPN addresses (203.0.113.0/24, one per line) and turn it on. From anywhere else, members see a page explaining why they can't get in. You can't save a list that leaves out your own address — the page shows it for you.

Who is signed in, and the audit log

Who is signed in shows each browser where a member is signed in. A lost laptop? Sign out that session — or Sign everyone else out. Everyone can do the same for themselves in Connected accounts.

The audit log records sign-ins with their address, settings changes, approvals, payments and provisioning. Download CSV or JSON lines for your records or your security tools.

Check yourself

1. You require single sign-on and your identity provider is down. Can anyone sign in?

Yes — the Org Owner, with their password. They can turn single sign-on off until it's back.

2. Someone leaves the company and is removed in your identity provider. What happens in Livra?

SCIM disables their account and signs them out at once. Their features and history stay.

3. Can you turn on an IP allow-list that doesn't include the address you're using?

No. It would lock you out, so it isn't saved.