Org Custom Identity Provider

Organizations on a Pro plan can let their members sign in through the org’s own identity provider (currently Microsoft Entra ID) instead of the shared GitHub login. This runs on top of the same shared Dex instance — no dedicated Dex or IdP deployment is created per org.

Prerequisites

• The org must have an active Pro plan (GET /v1/orgs/{org}/plan returning plan: pro). On self-hosted Registries with LORE_PRICING_ENABLED=false, this check is skipped.
• You must be the org’s Owner.
• You need a Microsoft Entra ID (Azure AD) tenant where you can register an application — or ask your company’s Entra admin to do it for you.

Step 1 — Register an application in Microsoft Entra ID

1. Sign in to the Azure Portal  and open Microsoft Entra ID → App registrations → New registration.
2. Give it a name (e.g. Lore Login).
3. Under Redirect URI, select Web and enter the Dex callback URL for your Registry:
   • Hosted SaaS: https://auth.lore.infraestrutura.app/callback
   • Self-hosted: <your-dex-issuer>/callback
4. After creation, note down:
   • Application (client) ID
   • Directory (tenant) ID
5. Go to Certificates & secrets → New client secret, create one, and copy its value immediately (it’s only shown once).

Step 2 — Configure the Identity Provider in the Lore panel

1. Open the org in the Lore panel and go to Settings → Identity Provider.

2. Fill in the form with the values from Step 1:

   Field	Value
   Tenant ID	The Directory (tenant) ID from Entra ID
   Client ID	The Application (client) ID from Entra ID
   Client Secret	The secret value you copied in Step 1
   Display Name	The text shown to end users on the login screen (defaults to the org’s display name)

3. Click Save.

The Registry validates the Tenant ID against Entra ID’s own discovery endpoint before saving — an invalid tenant is rejected inline and nothing is persisted. Once saved, the client secret is encrypted at rest; it is never returned by any API, including back to you.

Step 3 — Sign in with the org’s connector

Once configured, org members authenticate with:

lore login --org acme-corp

The CLI looks up the org’s connector via the public discovery endpoint and routes the Device Authorization Grant through Entra ID instead of the default GitHub flow.

# Public, unauthenticated — used internally by `lore login --org`
curl https://registry.lore.infraestrutura.app/v1/orgs/acme-corp/auth-connector
# → {"connectorId": "entra-acme-corp"}

If the org has no custom identity provider configured, lore login --org <slug> tells you so and suggests running lore login without --org.

Updating or removing the configuration

• Update: submit the form again with new values. The Tenant ID, Client ID, and/or Client Secret can all be changed; connectorId never changes once created.
• Remove: click Remove in the panel (or DELETE /v1/orgs/{org}/identity-provider). This deletes the Dex connector and the stored configuration entirely — members fall back to the default GitHub login.

What happens on downgrade

If the org’s plan is downgraded from Pro, the custom identity provider is suspended, not deleted:

• The Dex connector is removed, so sign-in via the org’s IdP stops working immediately.
• The saved configuration (tenant ID, client ID, display name) is kept, so nothing needs to be re-entered if the org upgrades back to Pro.
• The panel shows a message explaining the suspension while status.state is suspended.

Self-hosting

Reference

• lore login — CLI reference, including the --org flag
• Full design: openspec/changes/org-custom-identity-provider/design.md in the Lore repository