Google OAuth
signed SAML
LDAPS 636
dedicated tenant
Federate Google identities into UniFi
A dedicated Authentik tenant converts a verified @durwardsglen.org Google login into signed SAML for interactive access and a restricted LDAPS directory for UniFi synchronization.
Protocol boundary: this does not convert a Google password into an LDAP password. Google remains the interactive identity authority. The LDAP directory contains approved account records and one least-privilege machine bind account—never Google passwords, OAuth tokens, or refresh tokens.
Provisional paid-customer capability
This bridge is a design-complete, manually provisioned AlgoBlocker Enterprise capability. It is not generally available, not automatically enabled by payment, and has no published commercial price or SLA yet.
| Availability | Provisional; paid customers only; explicit scope and approval required |
|---|---|
| Estimated infrastructure | $22–$29 USD/month per isolated low-volume tenant; commercial pricing remains unset |
| Included capability | Google OAuth/OIDC, signed SAML, restricted LDAPS, isolated tenant configuration, pilot-first rollout, backup runbook |
| Not included | Google licensing, high availability, Cloudflare Spectrum, third-party PaaS charges, or automatic UniFi authorization |
| Durward's Glen | Deferred. Design files only; no compute, DNS, TLS listener, secrets, directory sync, or bridge onboarding provisioned |
1 · GoogleOAuth/OIDC login
2 · Authentiktenant and roster policy
3 · UniFi SSOsigned SAML
4 · UniFi syncLDAPS directory
Deployment readiness
This public check verifies DNS records and architectural flags, and reports the explicit tenant provisioning state. It cannot prove OAuth, SAML signatures, TLS, LDAP binds, or UniFi authorization.
GET /api/enterprise/identityNo check yet.
Control plane · HTTPS
identity.algoblocker.com→ Authentik port 9000- Google OAuth client is Internal to
durwardsglen.org - SAML assertions and responses are signed
- Only approved staff group members may reach UniFi
Directory plane · TCP/TLS
ldap.algoblocker.com:636→ LDAP outpost port 3389- Publicly trusted TLS certificate required
- Cloudflare DNS-only unless Spectrum custom TCP is enabled
- Bind account can search this provider only
Production gates
| Gate | Pass condition | Failure behavior |
|---|---|---|
| signature, issuer, audience, expiry, hosted domain, and stable subject validated | deny enrollment | |
| SAML | one test user signs in; UniFi validates signed assertion and response | retain break-glass owner |
| LDAPS | trusted TLS and least-privilege search return only approved tenant users | stop directory rollout |
| Authorization | door/camera roles are assigned separately inside UniFi | no automatic admin grant |
| Rollout | one account passes login, sync, Endpoint, and access checks | do not invite remaining users |
Operator runbook
- Deploy the pinned Authentik, PostgreSQL, worker, and LDAP-outpost containers.
- Create the Internal Google OAuth client and SAML signing keypair.
- Copy the exact UniFi ACS URL and Entity ID into protected Terraform variables.
- Apply the tenant configuration, then expose HTTPS 443 and LDAPS 636 with valid TLS.
- Run health, TLS, LDAP search, SAML login, and one-user Endpoint tests.
- Only after all gates pass, onboard the remaining approved roster.