Enterprise Members Authentication

Enterprise members refer to who have registered in the Dify Enterprise workspace or been added by administrators through the admin console. Our authentication system ensures these users can only access Dify Enterprise resources after proper verification.

​

Authentication Scope Overview

Dify Enterprise offers tailored authentication methods based on user roles and access requirements:

Access Target	User Role	Authentication Method	Security Level
Workspace	Enterprise Internal Users	Email & Password, Email & Verification Code, SSO	High
Web App	Enterprise Internal Users, Specific Group Users	Email & Password, Email & Verification Code, SSO	Medium

​

Authentication Method

System administrators can navigate to Admin Console → Identity Authentication → Member to centrally configure authentication methods for internal users accessing workspaces and Web Apps.

​

Email and Password Authentication

Applicable Scope:

• Workspace
• Web App

Features:

• Classic username and password authentication
• Configurable password security policies
• Suitable for all user types

Configuration Steps:

1. Identity Authentication → Member → Email and Password
2. Enable the toggle

Password Security Recommendations:

• Enforce minimum password length of 8 characters
• Include uppercase and lowercase letters, numbers, and special characters
• Regularly remind users to update passwords
• Prohibit common weak passwords

​

Email and Verification Code Authentication

Applicable Scope:

• Workspace
• Web App

Features:

• Passwordless login method
• Single-use email verification codes
• Enhances user experience by eliminating password management

Configuration Steps:

1. Verify that your email service is properly configured
2. Enable “Email and Verification Code” on Identity Authentication → Member page
3. Configure verification code parameters:
   • Verification code validity period (recommended 5-10 minutes)
   • Sending frequency limits
   • Verification code length and type

Prerequisites:

• SMTP email service configured
• Email service stable and available
• Valid user email addresses

​

Single Sign-On (SSO)

Applicable Scope:

• Workspace
• Web App

Features:

• Integration with existing enterprise identity systems
• Supports OIDC, SAML, OAuth2 protocols
• Unified enterprise identity management
• Supports automatic user synchronization

Configuration Steps:

1. Enable “Single Sign-On (SSO)” on Identity Authentication → Member page
2. Configure identity provider information
3. Set user attribute mapping
4. Test SSO connection

For detailed SSO configuration instructions, please refer to Enterprise SSO Configuration Guide.

​

Access Permission Management

​

Workspace

System administrators can enable email and password authentication, email and verification code authentication, and Single Sign-On (SSO) authentication methods in System Settings → Identity Authentication → Member. When users access the Dify Enterprise workspace, they’ll see authentication prompts based on your configuration settings and gain access upon successful verification. User Registration Strategies: Here are the most common user registration strategies:

​

Web App

When Web App access is set to All Platform Members or Specific Platform Groups, the authentication methods configured in “Enterprise User Authentication” (email/password, email verification codes, or SSO) will be automatically applied. Users not on the Dify Enterprise member list will receive an access denied message.

​

Security Best Practices

​

Authentication Strategy Recommendations

Enable Multiple Authentication Methods

• Use SSO as your primary method for centralized identity management
• Maintain email/password authentication as a fallback option
• Reserve email verification codes for emergency situations

​

Session Management

Session Security Configuration:

• Session Timeout: Recommended 7-30 days, adjust based on security requirements
• Concurrent Login Limits: Restrict simultaneous logins per user account
• IP Address Binding: Implement IP whitelisting for enhanced security environments

​

Password Policy

Strong Password Requirements:

• Minimum 8 characters, recommended 12+ characters
• Include uppercase and lowercase letters, numbers, and special characters
• Block commonly used weak passwords and dictionary attacks
• Enforce periodic password changes (every 90-180 days)

​

Troubleshooting

​

Common Issues

When accessing Web App, prompted with no access permission

User cannot log in, prompted with 'Authentication method not configured'

Email verification code cannot be sent or received

SSO login failure or cannot redirect

With proper enterprise user authentication configuration, you can deliver a seamless AI application experience while maintaining security. We recommend selecting authentication strategies that align with your organization’s security requirements and user base size.