Sign in with your own identity provider
LexCore authenticates against any OIDC provider, including one running inside your own network.
LexCore doesn't tie you to a particular identity vendor. It validates sign-in against any OpenID Connect provider, so your firm keeps whatever it already uses. A sovereign install can run its identity provider inside its own network, with no authentication traffic leaving the building.
| Provider | Typical use |
|---|---|
| Keycloak | The managed LexCore cloud, and self-hosted and air-gapped installs (ships with the sovereign package) |
| Microsoft Entra ID | Firms standardised on Microsoft 365 |
| Okta / Ping Identity | Larger enterprises with an existing SSO estate |
| Google Workspace | Firms on Google |
What this means in practice
- Single sign-on. Your people use the credentials they already have.
- Multi-factor authentication is enforced by your provider, under your policy, and LexCore requires it before sensitive actions.
- Off-boarding takes effect immediately. Access is checked on every request against your user record, not against a token issued earlier, so removing someone does not wait for a session to expire.
- A role change applies on the next action, for the same reason.
Self-registration is off
Nobody can create their own account on your instance. Users arrive by invitation from someone already inside your firm, or through your own SSO. An email address alone is never treated as proof of identity; only an address your provider has verified counts.
If your provider is misconfigured, LexCore refuses to start rather than starting in a weaker mode. A system that runs while silently accepting anyone is worse than one that will not run.
Related documentation
LexCore Sovereign: run it on your own servers
The self-hosted edition: what you receive, what you provide, and what it costs to run.
Security architecture: isolation, encryption and access
Tenant isolation enforced in both the app and the database, AES-256 encryption with keys sourced from a KMS, and access gated by role and MFA.
Data privacy and the no-training policy
Your documents are never used to train public models, and Nigerian data-protection handling under the Nigeria Data Protection Act (NDPA) 2023 is built into the platform.