Domain Routing¶
Domain Routing manages your tenant's privileged domains. Privileged domains let you route users to a specific identity provider and auto-assign them to groups based on their email domain.
Privileged domains are not protected (web) domains
A privileged domain here is an email domain (acme.com) used to route
identity and auto-assign groups. It is unrelated to a
protected domain, which is a DNS/web
domain proven with a DNS-TXT challenge so WeftID can gate HTTP apps behind it
with forward auth. The same string can be registered as both; they are
independent concepts. The two live in different top-level sections of the
app -- this page is under Identity Providers > Domain Routing; protected
domains are under Applications > Forward Auth > Domains -- so they no
longer sit side by side in the navigation, but the names are still easy to
mix up in conversation.
Adding a domain¶
- Navigate to Identity Providers > Domain Routing
- Click Add Domain
- Enter the email domain (e.g.,
acme.com) - Click Add
Binding an IdP¶
Each domain can be bound to one identity provider. When a user with a matching email domain signs in, they are automatically directed to that IdP instead of seeing the IdP selection page.
To bind an IdP, select it from the domain's configuration panel. Both SAML and OIDC connections appear as options.
The limit of one IdP per domain spans both protocols: a domain already bound to a SAML IdP cannot also be bound to an OIDC connection. Remove the existing binding first.
Linking groups¶
Link one or more groups to a domain. When a user is created with an email address matching that domain, they are automatically added to the linked groups.
This applies to both manually created users and JIT-provisioned users.
Example¶
- Add the domain
engineering.acme.com - Link it to the "Engineering" group
- When
alice@engineering.acme.comis created, she is automatically added to the Engineering group
Removing a domain¶
Unlink all groups and unbind the IdP before deleting a domain.