Access Control

Published web apps are public by default: anyone with the app URL can use it without signing in. When an app should not be open to everyone, your organization can require SSO sign-in for it.

​

Require SSO Sign-In

WebApp SSO works on two levels:

1. Enterprise level: An enterprise administrator enables WebApp SSO in the admin console and selects one protocol: SAML, OIDC, or OAuth2. See SSO Authentication.
2. App level: Open the app’s Monitoring page and click Settings on the web app card. The WebApp SSO switch in the SSO Enforcement section controls whether visitors must sign in through your organization’s SSO before using that app.

If the WebApp SSO switch is greyed out, your administrator has not enabled WebApp SSO yet — the switch shows “Contact the administrator to enable WebApp SSO”. Only workspace Editors and above can change the setting. Each published app is therefore in one of two states: public, or SSO-protected. Any user who can sign in through your organization’s SSO can use an SSO-protected app.

​

Find Your Apps

Workspace members signed in to Dify see the workspace’s apps on the Explore page and can open them from there.

​

Common Questions