BYO identity
Every Brand picks exactly one identity provider at onboarding. From that moment on, every user under the Brand — the Brand-Owner, every Tenant-Owner, every end-user of every Tenant — signs in through the Brand's own IdP. Aroovo never sits in the auth path.
Supported providers
Four first-class OIDC providers. All four use the same AuthProvider interface and the same multi-issuer JWT validator cache keyed by (brandId, providerId).
| Provider | Config shape | Notes |
|---|---|---|
| Microsoft Entra | entraTenantId, entraClientId | Default for the Aroovo Brand itself; MSAL.js on the console side. |
| Google Workspace | clientId, hostedDomain | hd claim enforced post-validate — sign-ins from outside the domain reject. |
| Okta | issuer, clientId | JWKS discovered via .well-known/openid-configuration. |
| Auth0 | tenantUrl, clientId, audience | Audience enforced post-validate; tokens intended for other Auth0 APIs rejected. |
Out of scope
Facebook and GitHub were considered and deferred — Facebook is unusual for B2B SaaS and GitHub's OAuth-not-OIDC flow plus email-visibility constraints didn't justify the special case without a Brand asking. SAML is intentionally not natively spoken — Okta and Auth0 both federate SAML for the Brands that need it. Multi-provider-per-Brand (a single Brand using Google for some users and Okta for others) is also out of scope for now.
How sign-in works at runtime
- User hits
agents.<brand-domain>oragents.aroovo.tech/b/<brandSlug>/sign-in. - Console reads the Brand's
authProvidersetting and dispatches into the matching provider's login flow (MSAL for Entra,oidc-client-tsfor the rest). - IdP returns a token. The platform validates it via the provider-specific implementation of
AuthProvider.validateToken— signature, issuer, audience, expiry, plus the provider-specific post-validate checks (Googlehd, Auth0aud). - User row is loaded by
(brandId, externalId). First sign-in lazily provisions the User against the inviting role.
Why this matters
Competitor analysis (2026-05-25) flagged this as Aroovo's most defensible wedge against Microsoft Copilot Studio: Copilot Studio refuses non-Entra customers; Aroovo signs them in on whichever IdP they already use. The shortest path to selling to a Google Workspace shop is to actually speak Google — not to ask them to set up Entra alongside.