Authentication & SSO

Secure access to Autonify through multiple authentication methods including email/password and Single Sign-On (SSO) with enterprise providers.

Overview

Autonify uses Supabase Authentication to provide secure, scalable authentication with support for:

• Traditional email/password authentication
• Single Sign-On (SSO) with Microsoft/Azure AD
• Session-based authentication with automatic token refresh
• First-time setup flow for initial platform configuration

Sign In Methods

Email & Password

Traditional authentication using email address and password:

1. Navigate to /login
2. Enter your Email (placeholder: "m@example.com")
3. Enter your Password
4. Click Login button (shows "Logging in..." when processing)
5. Additional elements:
   • Forgot your password? link (currently non-functional, goes to #)
   • Sign up link to go to registration
   • "Or continue with" divider separating email login from SSO

Password Requirements:

• Minimum 8 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one number
• At least one special character

Microsoft SSO

Sign in using your Microsoft/Azure AD account:

1. Navigate to /login
2. Click Sign in with Microsoft button
3. Authenticate with your Microsoft account
4. Automatically redirected back to Autonify

Benefits of Microsoft SSO:

• No separate password to manage
• Inherits your organization's security policies
• Automatic provisioning for new users
• Seamless integration with Microsoft 365

Creating an Account

Self-Registration

New users can create accounts through self-registration:

1. Navigate to /register or click Sign up from login page
2. Enter your full name
3. Enter email address
4. Create a strong password
5. Click Sign up button
6. Check email for confirmation (if email verification is enabled)

SSO Registration

Users can also register using SSO:

1. Navigate to /register
2. Click Sign in with Microsoft
3. Authenticate with Microsoft
4. Account automatically created with profile information

Note: SSO registration automatically populates your name from your identity provider profile.

First-Time Setup

When the first user signs in to a new Autonify instance:

Welcome Flow

1. Automatic Detection: System detects no existing users
2. Welcome Page: Redirected to /welcome
3. Initial Configuration:
   • Creates default team
   • Sets up initial permissions
   • Configures first user as Owner
4. Completion: Redirected to main application

This ensures the platform is properly initialized with at least one admin user who can manage the system.

User Permissions System

Application-Level Permissions

Three permission levels control platform-wide access:

Permission	Description	Capabilities
Owner	Full platform control	All features, user management, system settings
Admin	Administrative access	Access all teams, manage users, configure platform
User	Standard access	Access assigned teams only

Team-Level Permissions

Within teams, users have specific roles:

Role	Description	Capabilities
Admin	Team administrator	Full team control, member management, settings
Member	Standard member	Access all team resources, create content
User	Limited access	View-only for most resources

Permission Assignment

• First User: Automatically becomes Owner
• SSO Users: Automatically assigned User permission
• Manual Users: Permissions set by administrators
• Awaiting Approval: New users without permissions see awaiting approval page

Protected Routes

Authentication Requirements

Routes are protected by middleware that enforces:

1. Public Routes (no authentication required):

   • /login
   • /register
   • /auth/callback
   • /auth/auth-code-error

2. Authenticated Routes (require sign-in):

   • All other application routes
   • Automatic redirect to /login if not authenticated

3. Permission-Based Access:

   • Team routes require team membership or admin permissions
   • Settings pages require appropriate role level
   • Agent configurations require Member or Admin role

Route Protection Examples

Route Pattern	Required Permission
/team	Any authenticated user
/team/[name]	Team member or app Admin/Owner
/team/[name]/settings	Team Admin or app Admin/Owner
/team/[name]/members	Team Admin or app Admin/Owner
/team/[name]/datasource/[ds]/agents	Team Member/Admin or app Admin/Owner

Session Management

Session Lifecycle

• Duration: Sessions remain active with activity
• Refresh: Tokens automatically refresh before expiration
• Timeout: Inactive sessions expire after period of inactivity
• Storage: Secure HTTP-only cookies

Sign Out

Users can sign out through:

1. User profile menu in top-right corner
2. Click on profile icon
3. Select Sign Out option
4. Session terminated and redirected to login

Password Management

Changing Password

Authenticated users can change their password:

1. Click user profile icon
2. Select Change Password
3. Enter current password (for verification)
4. Enter new password (must meet requirements)
5. Confirm new password
6. Click Update Password

Password Reset

For forgotten passwords:

1. Click Forgot your password? on login page
2. Feature currently links to support for manual reset
3. Admin users can assist with password resets

Note: Self-service password reset via email is planned for future release.

User Profile

Profile Information

Users can view and update their profile:

• Name: Display name (editable)
• Email: Login email (read-only)
• Avatar: Profile picture via avatar_url

Updating Profile

1. Click profile icon in navigation
2. Select Profile option
3. Edit name or upload avatar
4. Changes save automatically

OAuth Callback Flow

Successful Authentication

1. User authenticates with identity provider
2. Provider redirects to /auth/callback with authorization code
3. Code exchanged for session tokens
4. User record created/updated in database
5. Redirected to intended destination or dashboard

Error Handling

Authentication errors redirect to /auth/auth-code-error with:

• Clear error message
• Option to retry authentication
• Link back to login page

Security Features

Token Security

• JWT tokens with short expiration
• Refresh tokens for extended sessions
• Secure HTTP-only cookie storage
• PKCE flow for OAuth

Rate Limiting

• Login attempts are rate-limited
• Protects against brute force attacks
• Temporary lockouts after failed attempts

Audit Trail

• Authentication events logged
• Session creation/termination tracked
• Failed login attempts recorded

Troubleshooting

Common Issues

Issue	Cause	Solution
"Authentication required"	Session expired	Sign in again
"Invalid login credentials"	Wrong email/password	Check credentials, reset password
Microsoft SSO fails	Azure AD configuration	Contact administrator
Stuck on "Awaiting Approval"	No permissions assigned	Contact administrator for access
Can't access team	Not a team member	Request team access from admin

SSO Configuration

For Microsoft/Azure AD SSO to work:

1. Application registered in Azure AD
2. Redirect URIs configured correctly
3. Client ID and secrets configured in Supabase
4. Users exist in Azure AD directory

Best Practices

For Users

• Use strong, unique passwords
• Enable SSO when available
• Sign out from shared devices
• Keep profile information updated

For Administrators

• Enforce SSO for organization users
• Regularly review user permissions
• Monitor authentication logs
• Configure session timeout appropriately
• Document team access policies

API Authentication

For programmatic access:

• Bearer token authentication required
• Tokens obtained via Supabase auth
• Include in Authorization header: Bearer [token]
• Tokens expire and must be refreshed

Example:

GET /api/data-sources
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Related Topics

• Authorization & RLS
• Team Management
• Managing Members