Connecting your identity provider to Confidencial

ℹ️
This document shows you how to connect to your identity provider, allowing your enterprise’s users to log in to Confidencial using their existing accounts.
The details of how to connect to your identity provider (IDP) vary depending on the IDP being connected, but in most cases, the process amounts to creating an application within your IDP and then assigning users to that application. See the links below for how to connect to your IDP.

Creating an application in Okta

  1. Log in to your Okta instance’s admin portal
  1. Click Applications under the Applications item in the side menu
  1. Click the Create App Integration button
  1. Select OIDC - OpenID Connect and Web Application for Sign-in method and Application type, respectively; click Next
  1. Ensure the following settings are entered:
    1. App integration name: Confidencial
    2. Grant type: Authorization Code (the only option that should be selected)
    3. Sign-in redirect URIs: https://auth.confidencial.io/login/callback
    4. Sign-out redirect URIs: https://my.confidencial.io
    5. ⚠️
      Redirect URIs will be different than those listed above for sandbox deployments. Your Confidencial technical contact will provide these URIs in these cases.
  1. For Controlled access, select either “Allow everyone in your organization to access” or “Limit access to selected groups,” depending on who you want to be able to log in to Confidencial.
    1. If you selected “Allow everyone…,” leave “Enable immediate access with Federation Broker Mode” selected if you want everyone in your organization to be able to access Confidencial. Deselect “Enable immediate access with Federation Broker Mode” if you want to specify the users and groups that can access Confidencial.
    2. If you selected “Limit access…,” enter the group(s) you’d like to access Confidencial under Selected group(s).
  1. Click Save
ℹ️
This completes creation of the Okta application and generates a Client Secret that must be securely transmitted to Confidencial during account set up (along with the Okta Domain and Client ID).
➡️
Proceed to the next section, Creating Confidencial roles for Okta users

Creating Confidencial roles for Okta users

ℹ️
These steps allow you to define Confidencial “roles” that allow you to grant various administrator permissions to your users by using Okta groups. The Confidencial permissions granted are determined by the description fields of the Okta groups to which each user belongs.

For each role you would like to define in Confidencial:

  1. Click Groups under the Directory item in the side menu
  1. Click Add Group
  1. In the Name field, enter a name for the role (Okta group). In this example, we create a role called C11-Admins.
  1. In the Description field, enter the Confidencial permissions you would like to grant to members of this role
    1. notion image
      ℹ️
      For a Confidencial user to be able to exercise any of the permissions described below, they must be designated as an administrator within the Confidencial system
      • crud:invitations-org: Allows an administrator to create, read, and delete invitations for an organization
      • crud:recovery-keys-org: Allows an administrator to create, read, and deactivate recovery keys that are used by an organization
  1. Click Save
  1. With the Okta group created, take note of the Okta group ID; this will be needed in the next section, Create the Okta authorization server for Confidencial
    1. To get the group ID of the group you created, go to the group in Okta and note the last part of the URL
      1. notion image
    2. In the example above, the group ID is 00g9372cmsozlGYI25d7
  1. Add the users to the group to which you would like to assign these permissions
🔁
Repeat Steps 1-7 above for each role you would like to define in the Confidencial system. You can create up to 100 roles for Confidencial users, roles can contain any combination of permissions, and users can belong to any combination of roles.
➡️
Proceed to the next section, Creating the Okta authorization server for Confidencial

Creating the Okta authorization server for Confidencial

  1. Click API under the Security item in the side menu
  1. Click Add Authorization Server
  1. For Name, enter Confidencial and for Audience enter api://confidencial.io
    1. notion image
  1. Click the Scopes tab, then click Add Scope
    1. notion image
  1. Enter the following values:
    1. Name: groups
    2. Display phrase: groups
    3. Description: Allows group membership to be passed in token
    4. Use default values for the other fields, as shown below
    5. notion image
  1. Click Access Policies, then click Add New Access Policy
    1. notion image
  1. Enter the following values:
    1. Name: Default
    2. Description: Default
    3. Assign to: Add the Okta application you created in the previous section, Creating an application in Okta
    4. notion image
  1. Click the Claims tab, then click Add Claim
    1. notion image
  1. Enter the following values:
    1. Name: permissions
    2. Value: Arrays.flatten(getFilteredGroups({"group-id-1", "group-id-2", ... , "group-id-n"}, "Arrays.flatten(group.description)", 100))
      1. Replace "group-id-1", "group-id-2", ... , "group-id-n" in the above statement with the list of group IDs you created in the section above, Creating Confidencial roles for Okta users
      2. Group IDs should be wrapped in double quotes () and separated by commas (,), with the entire list of group IDs wrapped in curly braces ({ })
    3. Use default values for the other fields, as shown below
    4. notion image
  1. Click Create
➡️
Proceed to the next section, Assigning users to an application in Okta

Assigning users to an application in Okta

ℹ️
These steps are not necessary if you left “Enable immediate access with Federation Broker Mode” selected in Step 6 of Creating an application in Okta above.
  1. Click Applications under the Applications item in the side menu
  1. Click Confidencial in the list of applications
  1. Click the Assignments tab
  1. Click Assign to add users and groups that can log in to Confidencial
This completes the setup of Okta for use with Confidencial. You will now work with the Confidencial team to securely transmit application details.

Creating an application in Microsoft Entra ID (formerly Azure Active Directory)

  1. Log in to the Microsoft Azure portal
  1. Click Microsoft Entra ID
  1. Click App Registrations from the side menu
  1. Click New Registration from the top toolbar
  1. Ensure the following settings are entered:
    1. Name: Confidencial
    2. Supported account types: Select either “Accounts in this organizational directory only,” “Accounts in any organizational directory,” or Accounts in any organization directory and personal Microsoft accounts,” depending on who you want to be able to join your Confidencial organization
      1. ℹ️
        Most organizations will want to select “Accounts in this organizational directory only,” as users outside your organization can log in to Confidencial via their own organization account or via an individual account.
    3. Redirect URI: Choose “Web” in the Select a platform drop down menu and enter https://auth.confidencial.io/login/callback in the input box
  1. Click Register
  1. Click Enterprise Applications from the side menu
  1. Click Confidencial in the list of applications
  1. Click Properties from the side menu
  1. If you want to specify the users that can log in to Confidencial, set Assignment required to “Yes,” otherwise, all users* will be able to log in to Confidencial
    1. All users with a supported account type specified in Step 5.b above
      All users with a supported account type specified in Step 5.b above
ℹ️
This completes creation of the Entra ID application and generates a Client Secret that must be securely transmitted to Confidencial during account set up (along with the Entra Domain and Client ID).
➡️
Proceed to the next section, Assigning users to an application in Entra ID

Assigning users to an application in Entra ID

ℹ️
These steps are only necessary if you selected “Yes” for Assignment required in Step 10 above.
  1. From the Microsoft Entra ID home screen, click Enterprise Applications from the side menu
  1. Click Confidencial in the list of applications
  1. Click Users and groups from the side menu
  1. Click Add user/group to add users and groups that can log in to Confidencial
This completes the setup of Entra ID for use with Confidencial. You will now work with the Confidencial team to securely transmit application details.