Welcome
Configure this identity platform before it accepts traffic. Complete each step in order. The connection string and secrets stay on the server — this wizard never displays them.
What you will configure
Each step covers one area. Values that depend on this server (URLs, time zone) are detected automatically. You only choose branding, language, organization identity, and the first administrator account.
- Database, Redis, and host URLs (first run)
- Database connectivity and migrations
- Branding and default language
- Root organization and platform administrator
- Security defaults (review only)
Host and database
On first run, configure this API host before the rest of setup. Connection strings stay on the server and are never shown again.
One API or two
A single API host can run without Redis. If you will run two API hosts (for example SSO1 and SSO2), enable Redis and use the same connection string on both. After save, copy appsettings.Runtime.json to the second host or set the same environment variables.
Test database, Redis (if enabled), host URL, and Admin URL separately before continuing.
Restart required
Infrastructure settings were saved. This process is recycling so the host can load the database. Refresh this page after a few seconds, or recycle the IIS application pool if it does not return.
Database
The host already loads the database connection from server configuration. You only verify connectivity and apply migrations here.
Why this step exists
The SSO platform stores users, applications, policies, and audit events in a relational database. The connection string is configured by your operator in host settings — not in this wizard. Here you confirm the database is reachable and schema migrations are applied before any identity data is created.
System
Choose how the platform appears to users. URLs and time zone are detected from this host automatically.
Branding vs. infrastructure
System name and display name appear on login pages, emails, and the admin panel. They do not affect OIDC issuer URLs or network routing — those come from the detected base URL below. Change URLs later in the admin panel if you deploy behind a reverse proxy or custom domain.
Detected automatically
These values are derived from the host you opened this wizard on. They are not editable here because misconfiguration would break login redirects and OIDC metadata.
- Base URL
- Public origin of this SSO host. Used for OIDC issuer, callback validation, and cookie scope.
- Public SSO URL
- URL shown to users and integrated applications. Initially identical to the base URL.
- Admin URL
- Management panel address (port 5100 by convention). Used after setup to open the admin login page.
- Default time zone
- Used for audit timestamps and scheduled operations. Detected from your browser/OS.
Organization
Root organization and primary tenant created during bootstrap.
Multi-tenant foundation
An organization is the top-level boundary for billing, policy, and administration. A tenant is an isolated identity space inside it (users, apps, roles). Setup creates one organization and one primary tenant — you can add more later from the admin panel.
Administrator
Platform administrator used after setup completes. Passwords are never logged or shown in review.
First platform operator
This account can manage users, applications, federation, and security settings across the platform. It is not an end-user account for business applications. Use a strong unique password; MFA can be enforced in the next step.
Authentication
Initial sign-in methods applied to the platform. These defaults are recommended for first deployment.
What gets enabled
Password login is required for the first administrator. External identity providers (OIDC/SAML) and tenant-wide MFA enrollment can be configured later from the admin panel once the platform is running.
- Password login — enabled for local accounts
- External IdP — configure later in Federation settings
- Mandatory MFA for all users — off until configured per policy
Security
Enterprise session and lockout defaults. Adjust fine-grained policies later in the admin panel.
Session and account protection
These limits reduce risk from stolen sessions and password guessing. They apply platform-wide at bootstrap. Administrators can tune policies per tenant or application after setup.
- Session idle (minutes)
- 30
- Inactive sessions expire after this period; user must sign in again.
- Session absolute (minutes)
- 480
- Maximum session lifetime regardless of activity (8 hours).
- Max failed logins
- 5
- Failed attempts before temporary lockout.
- Lockout (minutes)
- 15
- Duration of account lockout after too many failed logins.
Review
Confirm non-secret configuration before finishing. Passwords and connection strings are never shown.
Finish
Initialize the platform with the reviewed configuration. This step can run only once.
Admin login page
Go to admin login now