Enterprise Members Authentication

Enterprise members refer to who have registered in the Dify Enterprise workspace or been added by administrators through the admin console. Our authentication system ensures these users can only access Dify Enterprise resources after proper verification.

​

Authentication Scope Overview

Dify Enterprise offers tailored authentication methods based on user roles and access requirements:

​

Authentication Method

System administrators can navigate to Admin Console → Identity Authentication → Member to centrally configure authentication methods for internal users accessing workspaces and Web Apps.

​

Email and Password Authentication

Applicable Scope:

• Workspace
• Web App

Features:

• Classic username and password authentication
• Configurable password security policies
• Suitable for all user types

Configuration Steps:

1. Identity Authentication → Member → Email and Password
2. Enable the toggle

Password Security Recommendations:

• Enforce minimum password length of 8 characters
• Include uppercase and lowercase letters, numbers, and special characters
• Regularly remind users to update passwords
• Prohibit common weak passwords

​

Email and Verification Code Authentication

Applicable Scope:

• Workspace
• Web App

Features:

• Passwordless login method
• Single-use email verification codes
• Enhances user experience by eliminating password management

Configuration Steps:

1. Verify that your email service is properly configured
2. Enable “Email and Verification Code” on Identity Authentication → Member page
3. Configure verification code parameters:
   • Verification code validity period (recommended 5-10 minutes)
   • Sending frequency limits
   • Verification code length and type

Prerequisites:

• SMTP email service configured
• Email service stable and available
• Valid user email addresses

​

Single Sign-On (SSO)

Applicable Scope:

• Workspace
• Web App

Features:

• Integration with existing enterprise identity systems
• Supports OIDC, SAML, OAuth2 protocols
• Unified enterprise identity management
• Supports automatic user synchronization

Configuration Steps:

1. Enable “Single Sign-On (SSO)” on Identity Authentication → Member page
2. Configure identity provider information
3. Set user attribute mapping
4. Test SSO connection

For detailed SSO configuration instructions, please refer to Enterprise SSO Configuration Guide.

​

Access Permission Management

​

Workspace

System administrators can enable email and password authentication, email and verification code authentication, and Single Sign-On (SSO) authentication methods in System Settings → Identity Authentication → Member. When users access the Dify Enterprise workspace, they’ll see authentication prompts based on your configuration settings and gain access upon successful verification. User Registration Strategies: Here are the most common user registration strategies:

​

Web App

When Web App access is set to All Platform Members or Specific Platform Groups, the authentication methods configured in “Enterprise User Authentication” (email/password, email verification codes, or SSO) will be automatically applied. Users not on the Dify Enterprise member list will receive an access denied message.

​

Security Best Practices

​

Authentication Strategy Recommendations

Enable Multiple Authentication Methods

• Use SSO as your primary method for centralized identity management
• Maintain email/password authentication as a fallback option
• Reserve email verification codes for emergency situations

​

Session Management

Session Security Configuration:

• Session Timeout: Recommended 7-30 days, adjust based on security requirements
• Concurrent Login Limits: Restrict simultaneous logins per user account
• IP Address Binding: Implement IP whitelisting for enhanced security environments

​

Password Policy

Strong Password Requirements:

• Minimum 8 characters, recommended 12+ characters
• Include uppercase and lowercase letters, numbers, and special characters
• Block commonly used weak passwords and dictionary attacks
• Enforce periodic password changes (every 90-180 days)

​

Troubleshooting

​

Common Issues

When accessing Web App, prompted with no access permission

Possible Causes:

• SSO configuration not enabled
• Identity provider configuration error
• Network connection issues

Solutions: Contact your system administrator to verify SSO configuration at System Settings → Identity Authentication → Web App External User Verification.

User cannot log in, prompted with 'Authentication method not configured'

Root Cause Analysis: No authentication methods are currently enabled, or all methods have been disabled by the administrator.Solutions:

1. Check Identity Authentication → Member configuration
2. Enable at least one authentication method
3. Confirm email service configuration is normal (if using email verification code)
4. Test SSO connection status (if using SSO)

Email verification code cannot be sent or received

Possible Causes:

• SMTP email service configuration error
• Email server connection issues
• Invalid user email address
• Email filtered by spam

Solutions:

1. Verify SMTP server settings and connectivity
2. Confirm email server authentication credentials
3. Validate user email addresses
4. Advise users to check their spam/junk folders
5. Verify service status with your email provider

SSO login failure or cannot redirect

Possible Causes:

• Identity provider configuration error
• Incorrect callback address settings
• User lacks permissions in identity provider
• Network connection issues

Solutions:

1. Check identity provider configuration information
2. Confirm the callback URL is correctly configured
3. Verify user account status and permissions in your identity provider
4. Check network connectivity to your identity provider
5. Review system logs for detailed error messages

With proper enterprise user authentication configuration, you can deliver a seamless AI application experience while maintaining security. We recommend selecting authentication strategies that align with your organization’s security requirements and user base size.