LeaveFlow: Sign-in and integrations

Sign-in methods and integrations in LeaveFlow: Google Workspace, Microsoft Entra ID, LDAP, Slack, Microsoft Teams and the two-factor requirement.

Deutsche Version

Back to overview

You find all settings on this page under Admin → Organisation → Company settings (/admin/company/settings). Several sign-in methods can be active at the same time.

Method	Prerequisite	2FA in LeaveFlow
Local (email and password)	always available	optional or company-wide requirement, TOTP
Google Workspace	`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, switch in company settings	not applied, Google handles sign-in
Microsoft Entra ID	`ENTRA_CLIENT_ID`, `ENTRA_CLIENT_SECRET`, switch in company settings	not applied, Microsoft handles sign-in
LDAP / Active Directory	Connection in company settings, `APP_LDAP_ENCRYPTION_KEY`	still applies

The admin's local account keeps working while LDAP is active: the LDAP login does not intercept users with local sign-in.

With Google, Entra and LDAP, LeaveFlow automatically creates a user account with the Employee role on the first successful login (with LDAP depending on the group). This account has no employee record yet: link it under Employees with the field "Linked user", otherwise the person cannot request leave. If the email address already exists as another account, the login is rejected.

Google Workspace

Create an OAuth 2.0 client ID of type Web application in the Google Cloud project.
Enter https://<your-domain>/connect/google/check as authorized redirect URI.
Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in .env.local.
In company settings, in the "Google Workspace Login" block, click Enable Google login.
Optionally enter the domain (for example acme.com) in "Allowed Google Workspace domain (optional)" and save with Save domain restriction.

The sign-in page then shows "Sign in with Google". Google must report the email address as verified. Without a domain restriction any verified Google account can sign in and receives an employee account.

Microsoft Entra ID

Register an app in the Azure portal.
Enter https://<your-domain>/connect/entra/check as redirect URI.
Set ENTRA_CLIENT_ID and ENTRA_CLIENT_SECRET in .env.local, and for a single-tenant registration also ENTRA_TENANT_ID (default common).
In company settings, in the "Microsoft Entra ID Login" block, click Enable Microsoft login.
Fill in "Tenant ID (optional)" and save with Save Tenant ID.

Without a tenant ID in the company settings, users with personal Microsoft accounts can also sign in and may be able to claim email addresses of company employees. Always enter the tenant ID of your directory.

The sign-in page then shows "Sign in with Microsoft".

LDAP / Active Directory

In the "LDAP / Active Directory Login" block of the company settings you enter:

Field	Meaning
LDAP host, Port	Address of the directory service
Encryption	None (plaintext), STARTTLS or LDAPS (port 636)
Bind DN (service account)	Account used for the search; leave empty for an anonymous bind
Bind password	Stored encrypted; leave empty to keep the existing password
Base DN (user search)	Search base for users
User filter	Must contain `{username}` exactly once, for example `(uid={username})` or for Active Directory `(sAMAccountName={username})`
Manager group (DN), Admin group (DN)	Members receive the Manager or Administrator role

The bind password is not an environment variable: you enter it in the form and LeaveFlow stores it encrypted with APP_LDAP_ENCRYPTION_KEY. Enable with Enable LDAP login.

Users sign in with username and password on the normal sign-in page. The directory must provide a mail attribute for every user. The role from group membership is assigned only at the first login and is not synchronized with the directory afterwards.

STARTTLS or LDAPS protects the connection to the directory. With "None (plaintext)" username and password travel unencrypted over the network.

Slack

In the "Slack Integration" block you enter:

Field	Source in Slack
Bot token (`xoxb-…`)	"OAuth & Permissions" of the Slack app
Signing secret	"Basic Information" of the Slack app
Default channel ID (`C…`)	Channel ID, not the name

Token and secret are stored encrypted and switched on with Enable Slack integration. In the Slack app you set up these addresses:

Purpose	URL
Slash commands (`/urlaub`, `/team-abwesend`)	`https://<your-domain>/webhook/slack/commands`
Interactive components	`https://<your-domain>/webhook/slack/interactive`

Requests are verified with the Slack signature and must be at most five minutes old.

Function	Behavior
New request	LeaveFlow posts it to the default channel, with buttons to approve and reject
Decision	Posted to the channel; the requester additionally receives a direct message
`/urlaub` or `/urlaub request`	Opens a form for a leave request (full days)
`/team-abwesend`	Lists those absent today (up to 25)
Reject by button	Records the fixed reason "Abgelehnt über Slack"

Slash commands, direct messages and buttons identify the user by the Slack user ID, which must be stored on the LeaveFlow user (field slackUserId). The interface offers no input field for it. Without this mapping LeaveFlow answers "Dein Slack-Account ist nicht mit LeaveFlow verknüpft."

Microsoft Teams

In the "Microsoft Teams Integration" block you enter an incoming webhook URL, which must start with https://, and enable with Enable Teams integration. LeaveFlow then sends a card for every new request and every approval or rejection.

Two-factor authentication

Every user can set up TOTP at /profile/2fa (QR code or key, followed by 10 backup codes). In the "Require two-factor authentication" block you enable the requirement with Enable 2FA requirement and a deadline in the future. Until the deadline a banner is shown, afterwards LeaveFlow redirects every user without 2FA to the setup on every page. This applies regardless of sign-in method, including Google and Entra users; their login does not ask for a TOTP code though. If someone lost their device, reset 2FA under Users with "Reset 2FA".

Sign-in is limited to 5 attempts per 15 minutes. "Remember me" keeps the session for 7 days.