Hello,

I have a technical inquiry regarding the implementation of Single Sign-On (SSO) authentication with the Laserfiche Client in a self-hosted environment.

Currently, our Laserfiche system is integrated with Active Directory for user authentication. Users log in by entering their username and password, which are then validated against our organization's Active Directory.

We are now planning to replace the standard Laserfiche login process with the Saudi National Single Sign-On service, Nafath. Instead of entering Active Directory credentials directly in the Laserfiche login screen, users would authenticate through Nafath using their National ID.

After the user successfully authenticates through Nafath, our internal system would identify the corresponding user account associated with that National ID and map it to the appropriate Active Directory account. Based on this mapping, we would like the user to be automatically authenticated and granted access to Laserfiche without requiring a second login or re-entering Active Directory credentials.

Could you please advise on the recommended approach for implementing this authentication flow?

Specifically, I would like to understand:

• Is it possible to integrate an external Identity Provider (IdP) such as Nafath with a self-hosted Laserfiche environment?

• Does Laserfiche support authentication through standard protocols such as SAML 2.0 or OpenID Connect (OIDC) for this scenario?

• What components or configuration changes would be required to replace the default Laserfiche login screen with an external authentication process while allowing our application to map authenticated National IDs to existing Active Directory accounts?

• Are there any official implementation guides, best practices, or reference architectures for this type of integration?

Any guidance or documentation you can provide would be greatly appreciated.

Thank you.