Connecting your identity provider to Confidencial

Creating an application in Okta

1. Log in to your Okta instance’s admin portal

2. Click Applications under the Applications item in the side menu

3. Click the Create App Integration button

4. Select OIDC - OpenID Connect and Web Application for Sign-in method and Application type, respectively; click Next

5. Ensure the following settings are entered:
1. App integration name: Confidencial
2. Grant type: Authorization Code (the only option that should be selected)
3. Sign-in redirect URIs: https://auth.confidencial.io/login/callback
4. Sign-out redirect URIs: https://my.confidencial.io
⚠️
Redirect URIs will be different than those listed above for sandbox deployments. Your Confidencial technical contact will provide these URIs in these cases.

6. For Controlled access, select either “Allow everyone in your organization to access” or “Limit access to selected groups,” depending on who you want to be able to log in to Confidencial.
1. If you selected “Allow everyone…,” leave “Enable immediate access with Federation Broker Mode” selected if you want everyone in your organization to be able to access Confidencial. Deselect “Enable immediate access with Federation Broker Mode” if you want to specify the users and groups that can access Confidencial.
2. If you selected “Limit access…,” enter the group(s) you’d like to access Confidencial under Selected group(s).

7. Click Save

Creating Confidencial roles for Okta users

For each role you would like to define in Confidencial:

1. Click Groups under the Directory item in the side menu

2. Click Add Group

3. In the Name field, enter a name for the role (Okta group). In this example, we create a role called C11-Admins.

4. In the Description field, enter the Confidencial permissions you would like to grant to members of this role



ℹ️
For a Confidencial user to be able to exercise any of the permissions described below, they must be designated as an administrator within the Confidencial system
• crud:members-org: Allows an administrator to create, read, update, and deactivate all members in an organization
• crud:invitations-org: Allows an administrator to create, read, and delete invitations for an organization
• crud:recovery-keys-org: Allows an administrator to create, read, and deactivate recovery keys that are used by an organization
• read:events-org: Allows an administrator to see all Confidencial usage data within an organization
• crud:encryption-keys-org: Allows an administrator to create and update (replace) public and private encryption key pairs for all members in an organization
• crud:signature-keys-org: Allows an administrator to create and update (replace) electronic signature keys from all members in an organization
• crud:groups-org: Allows an administrator to create, read, update, and delete groups within an organization
• crud:groups-scim-tokens-org: Allows an administrator to create, read, update (replace), and delete tokens that are used by the enterprise’s identity provider to make calls to the SCIM endpoints of
  🔑
  The Confidencial Private Key Server

5. Click Save

6. With the Okta group created, take note of the Okta group ID; this will be needed in the next section, Create the Okta authorization server for Confidencial
1. To get the group ID of the group you created, go to the group in Okta and note the last part of the URL
2. In the example above, the group ID is 00g9372cmsozlGYI25d7

7. Add the users to the group to which you would like to assign these permissions

Creating the Okta authorization server for Confidencial

1. Click API under the Security item in the side menu

2. Click Add Authorization Server

3. For Name, enter Confidencial and for Audience enter api://confidencial.io

4. Click the Scopes tab, then click Add Scope

5. Enter the following values:
1. Name: groups
2. Display phrase: groups
3. Description: Allows group membership to be passed in token
4. Use default values for the other fields, as shown below

6. Click Access Policies, then click Add New Access Policy

7. Enter the following values:
1. Name: Default
2. Description: Default
3. Assign to: Add the Okta application you created in the previous section, Creating an application in Okta

8. Add a rule to govern access to this authorization server, ensuring that “authorization code” is permitted; set access token and refresh token lifetimes as desired

9. Click the Claims tab, then click Add Claim

10. Enter the following values:
1. Name: permissions
2. Value: Arrays.flatten(getFilteredGroups({"group-id-1", "group-id-2", ... , "group-id-n"}, "Arrays.flatten(group.description)", 100))
1. Replace "group-id-1", "group-id-2", ... , "group-id-n" in the above statement with the list of group IDs you created in the section above, Creating Confidencial roles for Okta users
2. Group IDs should be wrapped in double quotes (”) and separated by commas (,), with the entire list of group IDs wrapped in curly braces ({ })
3. Use default values for the other fields, as shown below

11. Click Create

Assigning users to an application in Okta

1. Click Applications under the Applications item in the side menu

2. Click Confidencial in the list of applications

3. Click the Assignments tab

4. Click Assign to add users and groups that can log in to Confidencial

Creating an application in Microsoft Entra ID (formerly Azure Active Directory)

1. Log in to the Microsoft Azure portal

2. Click Microsoft Entra ID

3. Click App Registrations from the side menu

4. Click New Registration from the top toolbar

5. Ensure the following settings are entered:
1. Name: Confidencial
2. Supported account types: Select either “Accounts in this organizational directory only,” “Accounts in any organizational directory,” or Accounts in any organization directory and personal Microsoft accounts,” depending on who you want to be able to join your Confidencial organization
ℹ️
Most organizations will want to select “Accounts in this organizational directory only,” as users outside your organization can log in to Confidencial via their own organization account or via an individual account.
3. Redirect URI: Choose “Web” in the Select a platform drop down menu and enter https://auth.confidencial.io/login/callback in the input box

6. Click Register

7. Click Enterprise Applications from the side menu

8. Click Confidencial in the list of applications

9. Click Properties from the side menu

10. If you want to specify the users that can log in to Confidencial, set Assignment required to “Yes,” otherwise, all users* will be able to log in to Confidencial

All users with a supported account type specified in Step 5.b above

Assigning users to an application in Entra ID

1. From the Microsoft Entra ID home screen, click Enterprise Applications from the side menu

2. Click Confidencial in the list of applications

3. Click Users and groups from the side menu

4. Click Add user/group to add users and groups that can log in to Confidencial