Security
Access Control
IP Whitelist and login methods (OAuth/SSO) — Configuration and operation
Enneo provides two independent mechanisms for controlling system access: a network-based IP whitelist and an identity-based configuration of the permitted login methods. Both mechanisms operate at different levels and can be combined.
IP Whitelist
The IP whitelist restricts access to enneo based on the network address of the requesting client. If this setting is active, all requests from users whose IP address is not contained in the list will be rejected.
The configuration can be found under
Advanced Settings → Privacy → Access Control - IP Whitelist.
The setting accepts a list of IP addresses or CIDR ranges. Both IPv4 and IPv6 are supported.
["192.168.1.0/24", "10.0.0.5", "2001:db8::/32"]If the list is empty, access without IP restriction is possible. As soon as at least one entry is set, every request is checked — if there is a match, access is granted, otherwise it is denied.
Tip
When setting the IP whitelist, the system checks whether the own IP address of the configuring user is also included in the list. If this is not the case, the storage will be denied — as protection against accidental self-blocking.
Login Methods (OAuth / SSO)
Enneo supports multiple login methods, which can be configured per tenant.
The SSO configuration can be found at Advanced Settings → Single Sign-On.
Allowed Login Methods
The setting determines which login types are active:
| Value | Description |
|---|---|
microsoft | Microsoft Azure AD / Entra ID (OAuth2/OIDC) |
google | Google OAuth2 |
oauth | Generic OAuth2 provider (configurable) |
local | Local login with email and password |
Note
Users who were created exclusively via SSO cannot log in via
the local login — even if local is enabled.
Allowed Email Domains
If this setting is set, new users are only created if their email address belongs to one of the configured domains.
["example.com", "partner.org"]Info
Existing users are not affected — the check is only carried out when a new account is initially created via SSO. If the list is empty or not set, there are no domain restrictions.