Enterprise Security (SSO, LDAP, Permissions)
Relevant source files
The following files were used as context for generating this wiki page:
n8n provides a suite of enterprise-grade security features designed to integrate with corporate identity systems and enforce granular access control. These features include Single Sign-On (SSO) via SAML and OIDC, user authentication via LDAP directories, and a robust, project-based permissions system for managing user access to resources like workflows and credentials.
This document outlines the architecture and implementation of these security modules, providing a technical overview for developers and administrators. The system is designed to be modular, allowing organizations to enable and configure the authentication methods and access controls that fit their security posture.
Single Sign-On (SSO)
SSO allows users to authenticate using a central Identity Provider (IdP), streamlining the login process and centralizing user management. n8n supports the two most common SSO standards: SAML and OIDC. These services are part of the enterprise edition (.ee) extensions.
SAML
The SAML (Security Assertion Markup Language) integration allows users to log in to n8n through any SAML 2.0 compliant Identity Provider. The SamlService handles the creation of authentication requests and the consumption of assertions from the IdP.
Sources: packages/cli/src/sso.ee/saml/saml.service.ee.ts
Authentication Flow
The diagram below illustrates the SAML authentication sequence initiated by a user.
Key Components
| Component | Description | Source File |
|---|---|---|
SamlService | The main service class that orchestrates the SAML authentication flow. | saml.service.ee.ts:33 |
getLoginUrl() | Generates the redirect URL to the Identity Provider, including the encoded SAML authentication request. | saml.service.ee.ts:46-68 |
consumePost() | The Assertion Consumer Service (ACS) endpoint handler. It receives the POST request from the user's browser, validates the SAML assertion from the IdP, and logs the user in. | saml.service.ee.ts:70-136 |
findOrCreateUserFromSamlProfile() | Provisions or updates a user in the n8n database based on the attributes (e.g., email, name) received in the SAML profile. | saml.service.ee.ts:153-176 |
OIDC
The OIDC (OpenID Connect) integration provides authentication using any OIDC-compliant provider. The OidcService manages the OIDC authorization code flow.
Sources: packages/cli/src/sso.ee/oidc/oidc.service.ee.ts
Authentication Flow
The diagram below shows the OIDC authentication sequence.
Key Components
| Component | Description | Source File |
|---|---|---|
OidcService | The main service class that orchestrates the OIDC authentication flow. | oidc.service.ee.ts:35 |
getLoginUrl() | Generates the authorization URL that redirects the user to the Identity Provider for authentication. | oidc.service.ee.ts:50-70 |
consume() | The callback handler. It receives the authorization code, exchanges it for tokens, validates the ID token, and retrieves user information from the IdP. | oidc.service.ee.ts:72-140 |
findOrCreateUserFromOidcProfile() | Provisions or updates a user in the n8n database based on the claims (e.g., email, name) from the OIDC user profile. | oidc.service.ee.ts:157-180 |
LDAP Integration
n8n can be configured to authenticate users against an LDAP (Lightweight Directory Access Protocol) or Active Directory server. The LdapService is responsible for this integration.
Sources: packages/cli/src/ldap.ee/ldap.service.ee.ts
Authentication Flow
The LDAP authentication process involves binding to the directory, searching for the user, and then re-binding with the user's provided credentials to verify their password.
Key Components
| Component | Description | Source File |
|---|---|---|
LdapService | The main service class that handles LDAP authentication logic. | ldap.service.ee.ts:28 |
authenticate() | The core method that takes a username and password, connects to the LDAP server, searches for the user, and validates their credentials. | ldap.service.ee.ts:40-128 |
findOrCreateUserFromLdapEntry() | Provisions or updates an n8n user based on attributes from the LDAP user entry (e.g., uid, mail, givenName). | ldap.service.ee.ts:145-167 |
Permissions and Access Control
n8n implements a project-based access control system to manage what users can see and do. This system is built around projects, users, roles, and permissions.
Core Concepts
The permission model is based on the relationship between users, projects, and roles. Resources like workflows and credentials belong to a project, and a user's access to those resources is determined by the role they are assigned within that project.
The diagram below shows the entity relationships for the access control model.
Sources: packages/cli/src/services/project.service.ee.ts:114, [packages/testing/playwright/tests/ui/39-projects.spec.ts:100-104]
Project Management
The ProjectService is central to managing access. It handles the creation of projects and the assignment of users to those projects with specific roles.
- Creating Projects: New projects can be created to logically group resources.
- Adding Users: The
addUser()method assigns a user to a project with a role (e.g.,project:editor), granting them the permissions associated with that role for all resources within that project. - Moving Resources: The
moveResource()method allows for transferring resources like workflows and credentials between projects, which subsequently changes which users can access them.
Sources: [packages/cli/src/services/project.service.ee.ts:60, 114, 180]
Permissions
Permissions are granular actions that can be performed on a resource. They are defined centrally and form the basis of roles.
The following table lists some of the key permissions defined in the system.
| Permission Name | Description |
|---|---|
credential:create | Create a credential |
credential:delete | Delete a credential |
credential:read | Read a credential |
credential:update | Update a credential |
project:create | Create a project |
project:delete | Delete a project |
project:read | Read a project |
project:update | Update a project |
user:create | Create a user |
user:delete | Delete a user |
user.role:update | Update a user's role |
workflow:create | Create a workflow |
workflow:delete | Delete a workflow |
workflow:read | Read a workflow |
workflow:update | Update a workflow |
Sources: [packages/@n8n/permissions/src/index.ts:10-164]
Roles
Roles are collections of permissions. While the full role definitions are not present in these files, end-to-end tests reveal the usage of predefined roles like project:editor and project:admin, which are enabled via feature flags. These roles are assigned to users on a per-project basis.
Sources: [packages/testing/playwright/tests/ui/39-projects.spec.ts:32-34, 103]
Conclusion
n8n's enterprise security features provide a comprehensive framework for secure user management and access control. By integrating with standard corporate identity systems like SAML, OIDC, and LDAP, n8n simplifies user onboarding and authentication. The project-based permission system ensures that access to sensitive resources is properly controlled, allowing teams to collaborate securely within isolated environments. This combination of features is essential for deploying n8n in enterprise settings where security and compliance are paramount.