Authentication and authorization
LeapView separates authentication, provisioning, authorization, workload identity, credentials, and auditing. Use this page to choose the security workflow or concept you need.
Choose how people sign in
- Use Local authentication for self-hosted users and a controlled break-glass path.
- Use OIDC for interactive enterprise browser login.
Both sign-in modes resolve an ordinary LeapView principal. Authentication proves identity; it does not grant workspace or resource access.
Provision identities and workloads
- Use SCIM provisioning to synchronize enterprise users, directory groups, memberships, and active state.
- Use Service principals and API tokens for CI, deployment, data publishing, monitoring, and other non-human workloads.
OIDC subject identity, SCIM directory state, and service-principal lifecycle remain distinct so that sign-in, provisioning, and automation can change without becoming authorization shortcuts.
Govern access
Read Roles, grants, and policies to understand securable hierarchy, workspace roles, explicit grants, ownership, and row or column data policy. LeapView authorization remains authoritative regardless of how the principal was authenticated or provisioned.
Use Audit events to investigate security-sensitive changes and correlate them with governed query activity.
Look up exact contracts
Use the generated Environment variable reference for authentication and security settings, the Access API reference for principals and grants, the Current User API reference for sessions and user tokens, and the Audit API reference for event operations.