Authentication and authorization
LeapView separates authentication, provisioning, authorization, workload identity, credentials, and auditing. Use this page to choose the security workflow or concept you need.
Choose how people sign in
- Use Local authentication for self-hosted users and a controlled break-glass path.
- Use OIDC for interactive enterprise browser login.
- Use the MFA security decision boundary to distinguish provider-enforced MFA from application-managed assurance, which is not currently supported.
- Use browser/device authorization for
leapview login <target>; CLI credentials remain separate from browser and Desktop sessions.
Both sign-in modes resolve an ordinary LeapView principal. Authentication proves identity; it does not grant project-resource access.
Provision identities and workloads
- Use SCIM provisioning to synchronize enterprise users, directory groups, memberships, and active state.
- Use service principals and short-lived workload identity for CI, deployment, data publishing, monitoring, and other non-human workloads. API tokens are a compatibility path.
OIDC subject identity, SCIM directory state, and service-principal lifecycle remain distinct so that sign-in, provisioning, and automation can change without becoming authorization shortcuts.
Govern access
Read Roles, grants, and policies to understand securable hierarchy, project-resource roles, explicit grants, ownership, and row or column data policy. LeapView authorization remains authoritative regardless of how the principal was authenticated or provisioned.
Use Audit events to investigate security-sensitive changes and correlate them with governed query activity.
Look up exact contracts
Use the generated Environment variable reference for authentication and security settings, the Access API reference for principals and grants, the Current User API reference for sessions and user tokens, and the Audit API reference for event operations.