Sign in with your own identity provider
LexCore authenticates against any OIDC provider — including one running inside your own network.
LexCore does not require you to use a particular identity vendor. It validates sign-in against any OpenID Connect provider, so your firm keeps whatever it already uses — and a sovereign install can run an identity provider inside its own network, with no authentication traffic leaving the building.
| Provider | Typical use |
|---|---|
| Keycloak (bundled) | Self-hosted and air-gapped installs — ships with the sovereign package |
| Microsoft Entra ID | Firms standardised on Microsoft 365 |
| Okta / Ping Identity | Larger enterprises with an existing SSO estate |
| Google Workspace | Firms on Google |
| Auth0 | The managed LexCore cloud |
What this means in practice
- Single sign-on — your people use the credentials they already have.
- Multi-factor authentication is enforced by your provider, under your policy, and LexCore requires it before sensitive actions.
- Off-boarding takes effect immediately. Access is decided per request against your user record, not against a token issued earlier — so removing someone does not wait for a session to expire.
- A role change applies on the next action, for the same reason.
Self-registration is off
Nobody can create their own account on your instance. Users arrive by invitation from someone already inside your firm, or through your own SSO. An email address alone is never treated as proof of identity — only an address your provider has verified.
If your provider is misconfigured, LexCore refuses to start rather than starting in a weaker mode. A system that runs while silently accepting anyone is worse than one that will not run.
Related technical documentation
LexCore Sovereign: run it on your own servers
The self-hosted edition — what you receive, what you provide, and what it costs to run.
Security architecture: isolation, encryption & access
Tenant isolation enforced at both the app and database layers, AES-256 encryption with KMS key sourcing, and role- plus MFA-gated access.
Data privacy & the no-training policy
Your documents are never used to train public models, and Nigerian data-protection handling (NDPA 2023) is built into the platform.