Web authentication
Web authentication controls how employees prove who they are when they open the assistant in a browser — through the web app or an embedded widget.
Where to find it
Open the Admin Console, then go to Leena Channels → Web authentication.
Each surface is configured separatelyWeb authentication covers browser access only. The mobile and desktop apps are configured on Apps authentication, and settings shared across both live on Other auth settings.
1. Authentication setup
Start by choosing a Select authentication method. The rest of the form changes to match.
| Method | When to use it |
|---|---|
| OTP | A one-time code sent to the employee's email or mobile. No identity provider needed |
| SSO | SAML-based single sign-on against your identity provider |
| OAuth | OAuth sign-in with Azure or Google |
| Custom | A custom authentication API, for anything the other three don't cover |
OTP
Add allowed domains restricts which email domains can request a code — anything outside the list is refused. This is the main control on who can reach the assistant, so set it before going live.
Allow login via mobile number lets employees use a mobile number instead of email.
Send test OTP verifies delivery end to end without leaving the page. Enter a Mobile number or an Email and trigger a real code. If no valid recipient is found, the page tells you rather than failing silently. Test both channels if you've enabled both — email and SMS delivery fail independently.
SSO
Choose a Select SSO type:
| Type | What it does |
|---|---|
| Single IDP SSO | One SAML app for everyone. Pick it under Select SAML app |
| Multiple IDP SSO | Several SAML apps, each serving different employees |
With multiple IDPs, each entry takes a SAML app and Add allowed domains for SAML app — the domains routed to that provider. Mark one entry Set this app as default to catch anyone whose domain doesn't match, and use Add more to add further providers.
SAML apps themselves are created under SAML apps, not here. This page only selects among them.
OAuth
Pick an OAuth provider — Azure or Google. The page won't save without one.
Custom
Selecting Custom reveals 2. Custom API input, where you supply the Service Name and the inputs your authentication service expects.
Profile and field mapping
These options appear alongside the method, and determine what the assistant knows about an employee once they've signed in.
| Setting | What it does |
|---|---|
| Save SAML profile | Stores the profile returned by the identity provider. Turning it on reveals Add SAML profile fields, where you list the fields to keep |
| Create integrations user | Creates a matching user record for downstream integrations, mapping each SAML profile field to an Integration profile field |
| Login field mappers | Maps an Auth field to a Profile field, so the identity returned at login resolves to the right employee record |
Get the mapping right before launch. If the login field doesn't resolve to an employee, sign-in succeeds but the assistant can't personalise anything or run workflows on that person's behalf.
Session and messaging
| Setting | What it does |
|---|---|
| Successful login message | What employees see once they're signed in |
| Channel authorization expression | An expression controlling authorization for this channel |
| Allow token expiry timeout | Enables a session limit. Turning it on reveals Session timeout (seconds) |
Saving and removing
Save applies the configuration, and a confirmation appears.
Remove authentication clears the setup entirely, after a confirmation prompt. Employees will no longer be challenged on this channel, so treat it as a change to make deliberately rather than a way to reset the form.
Updated 15 days ago