Introduction
What Longbridge Identity is — one sign-in for every tool your team runs — and how connected apps work.
Early access. Identity is rolling out behind an organization flag. It is free of charge — there is no SSO tax here, and there never will be.
Longbridge Identity signs your team into the tools you run — a Grafana, a Backstage, an internal dashboard — with the Longbridge accounts they already have. You register each tool as a connected app, paste three values into its OIDC settings, and you’re done: no GitHub OAuth app to create, no Google Cloud console to click through, no user list to keep in sync.
Why it exists
Every team that self-hosts tools ends up rebuilding the same thing: an OAuth app per tool per provider, a mapping from accounts to permissions, and an offboarding checklist nobody runs completely. Your organization’s membership already lives here — Identity serves it over standard OIDC.
- Only your members can sign in. Sign-in to a connected app is hard-gated on membership in your organization. A tool that grants default access to “anyone who authenticated” is safe behind it, because nobody outside your org can authenticate.
- Roles arrive as groups. With the
groupsscope, tokens carry the member’s roles — built-in ones likeownerorgitops.admin, and any custom role by its name. Map them to the tool’s own permissions once, and role changes in Longbridge take effect at the next sign-in. - Offboarding is instant. Remove a member and their next request is refused — new sign-ins, and refresh tokens too.
- Restrict who may enter. A connected app can be limited to named roles, so the admin tool is reachable by the platform team and nobody else.
Connected apps
A connected app is one registered tool. It has a name, one or more exact-match redirect URIs, and a client type:
- Confidential — a server-side app (Grafana, Backstage, Outline). Holds a client secret, shown once at registration and rotatable any time.
- Public — a SPA or CLI that can’t keep a secret. Uses PKCE instead.
Your GitOps instances appear in the list automatically as system-managed apps — the platform registers their Argo CD for you, and their lifecycle follows the instance.
Where to go next
Register an app in the Console under Identity → Connected apps, or from the terminal:
lbr identity app create grafana \
--redirect-uri https://grafana.example.com/login/generic_oauthThen follow the recipe for your tool: Grafana, oauth2-proxy for tools without built-in SSO, or the generic OIDC settings for everything else.