Login Providers
Launchpad supports various authentication providers for both logging users into Launchpad and connecting to Stardog endpoints. Each provider has its own configuration requirements and capabilities.
Launchpad should be configured with at least 1 SSO provider to log users into the application. You may use shared user authentication to bypass the need to have a SSO login provider, but this is not recommended for production use.
| Provider | Login Provider | SSO Connections |
|---|---|---|
| Microsoft Entra | ✅ | ✅ |
| Auth0 | ✅ | ❌ |
| ✅ | ❌ | |
| Okta | ✅ | ✅ |
| PingOne | ✅ | ✅ |
| Duo | ✅ | ❌ |
| Kerberos | ✅ | ✅ |
| Shared User | ✅ | ❌ |
SSO Connection Configuration
SSO Connections allow logged-in users to authenticate against Stardog endpoints using SSO tokens. This requires both Launchpad and the Stardog endpoint to be configured with the same SSO provider.
SSO connections use the SSOCONNECTION_<unique_identifier>_<provider_identifier>_<config_option> environment variable pattern. For example:
SSOCONNECTION_DEVELOPMENT_AZURE_CLIENT_ID=<client_id>
SSOCONNECTION_DEVELOPMENT_AZURE_CLIENT_SECRET=<client_secret>
SSOCONNECTION_DEVELOPMENT_AZURE_TENANT=<tenant_id>
SSOCONNECTION_DEVELOPMENT_AZURE_STARDOG_ENDPOINT=http://localhost:5825
SSOCONNECTION_DEVELOPMENT_AZURE_DISPLAY_NAME=Development
The unique identifier must not contain underscores or special characters. Use only alphanumeric characters.
Even if your login provider is the same as your connection provider (e.g. Microsoft Entra), they should be different applications in the SSO provider. This ensures proper security boundaries between Launchpad authentication and Stardog endpoint access.
Internal Stardog Endpoint Configuration
SSO connections support configuring an additional internal or private endpoint for server-side operations using the SSOCONNECTION_<unique_identifier>_<provider_identifier>_STARDOG_INTERNAL_ENDPOINT environment variable. This is particularly beneficial for the Voicebox service container, which may not be able to access Stardog on the public endpoint but can communicate using an internal endpoint.
SSOCONNECTION_DEVELOPMENT_AZURE_STARDOG_INTERNAL_ENDPOINT=http://stardog-internal:5820
When both public and internal endpoints are configured:
- Browser-based requests (Studio, Explorer, Designer, Knowledge Catalog) use the public endpoint
- Server-side requests (Voicebox) automatically use the internal endpoint
This supports architectures where different network routes are required for backend services versus browser-based access. Users can override the internal endpoint in the “Advanced Options” section when creating SSO connections in the Launchpad UI.
For detailed setup instructions for each provider, see the individual provider configuration guides linked in the table above.