Corporate sign-in: AD FS, JIT and access groups

AD FS authenticates the employee’s domain account. BusinessProxy controls access to work resources. A workspace owner or administrator configures the connection with the AD FS administrator.

• Open Team → SSO in the intended workspace. Copy its OIDC callback URL into the BusinessProxy application registration in AD FS.
• Prepare the HTTPS issuer URL, client ID and client secret. AD FS uses direct OIDC authorization code flow with PKCE S256.
• Set up a BusinessProxy passkey or authenticator. Group mapping changes and directory settings require fresh BusinessProxy verification.

Add a connection or choose Edit from its menu. Explicitly select Microsoft AD FS (OIDC). An existing generic OIDC connection keeps its profile until an administrator changes it.

• Enter the issuer URL and client ID from your registration. Leave Client secret empty when editing to retain the existing secret.
• The basic openid scope supports already linked users. For additional corporate claims, the AD FS administrator configures a dedicated BP resource, permits openid allatclaims and supplies the AD FS resource value.
• Set Groups claim to the exact claim name configured in AD FS, for example bp_groups if that is the name your provider issues.
• Test connection checks metadata and signing keys. Complete this check with an actual employee sign-in.

Enable Create users at first sign-in (JIT) for new employees. They open the SSO link and sign in with their domain account without creating a personal link first.

• AD FS must supply a signed corporate email and its verification claim. The organization administrator defines the authoritative email domain. Missing verification prevents account creation.
• A new user receives the ordinary member role. JIT and corporate groups do not grant BusinessProxy or CMS administrator roles.
• An existing BP account with the same email is not linked automatically. Its owner uses Corporate sign-in in their profile and verifies both accounts.
• Instead of general JIT, import selected AD employees and explicitly allow their first sign-in. Without JIT or that permission, new accounts are not created. A manual BP administrator deny remains in effect.

Open Groups and access from the connection menu. Select an existing BusinessProxy group, enter a stable SID or another exact value from the signed claim, then confirm with a BP passkey or authenticator code.

• Assign the group access in the relevant CMS or application settings. A mapping alone does not open resources.
• Review the base role permission. Removing an allow-group membership does not block a resource that remains open to all ordinary members.
• Without import, membership updates at the next SSO sign-in. With AD synchronization enabled, the accepted directory selection supplies group membership. Manual BP grants and denies are preserved.
• Bitrix and other application roles remain managed in those systems. Signing in to BP does not replace native permission management.

Choose AD directory from the connection menu. A BusinessProxy operator first approves the controller, network address and trusted CA for your workspace. The directory then appears in the list.

• Use a dedicated service account with read permissions. Enter its DN, password and the selected group DNs, one per line.
• Save with BP verification, then select Preview employees. The result shows counts, group SIDs and up to 20 sample users.
• Preview does not import employees, verify email ownership or change permissions. Incomplete results are rejected.
• The operator selects direct LDAPS or a connector beside private AD. Both profiles verify the controller certificate and name. The connector also checks its locally approved addresses and directory scope.

Use this step when AD is not reachable directly from BusinessProxy. The administrator obtains an individual certificate and configuration from the BusinessProxy operator for the specific workspace, SSO connection and directory. Run the directory reader beside the controller or the ordinary web-application connector.

businessproxy-directory-connector --config /private/path/directory-agent.json

• Extract the archive for your OS. Store the individual certificate, key and configuration in a directory accessible only to the service identity. On Windows, run businessproxy-directory-connector.exe.
• Allow outbound HTTPS to directory.business-proxy.com:443 and LDAPS to the selected controller. The connector requires no inbound port in the organization network. An ordinary web-connector token cannot authorize this channel.
• Under AD directory, select the approved connector-backed directory, save the service identity with BP verification and run a preview. The AD password is delivered for a short-lived task over mTLS and is not written to the connector configuration.
• The same import and schedule are available after preview. If the connector stops, the previous inventory is retained. When replacing or revoking a certificate, the operator updates certificate admission and the administrator confirms the current directory settings.

Under AD directory → Employee import and synchronization, select Import directory and confirm with a BP passkey or authenticator code. The complete result is saved as the directory inventory. BusinessProxy accounts are created only at verified first SSO sign-in.

• The AD FS administrator must supply one signed employee SID, for example bp_object_sid. Enter the exact claim name. Email and login do not replace SID or link existing accounts.
• After a successful import, enable Allow imported employees to sign in. This is a separate permission, so general JIT may stay off. The employee must use a verified corporate email matching their AD record.
• Choose on-demand updates or updates every 5 minutes. In on-demand mode, AD changes take effect after the next administrator import. The employee inventory supports search, filters and additional pages.
• To reject sign-in outside the selected directory scope, enable Restrict SSO to eligible directory employees. This requires scheduled updates. Every lifecycle policy change requires fresh BP verification.

An accepted AD disable or removal from selected groups ends the employee’s managed corporate access. BusinessProxy revokes the related application, CMS and browser-proxy sessions. Direct public access outside BusinessProxy requires the application’s own protection.

• With scheduled updates, managed corporate access pauses after 10 minutes without a successful update. The last accepted inventory is retained. Check the controller, CA and service account, then update the directory.
• Incomplete reads are rejected. Disabling more than 20 employees and more than 20% of the previously eligible selection requires separate approval of that exact result. A changed result must be reviewed again.
• Re-enabling AD does not reopen old sessions. A new SSO sign-in is required. Only ordinary membership disabled by the directory itself can be restored automatically. A manual BP administrator disable remains in effect.
• Review resource base roles and manual grants. Removing an allow-group membership does not cancel a separate grant. Synchronization does not assign native Bitrix or other application roles.

Copy the employee link from Groups and access. It opens the selected SSO connection and contains no password or session token. Enter the AD password only on the AD FS page.

• Test a new employee in an allowed group: an ordinary member account is created and the assigned application opens.
• Test an employee without access, a new sign-in after a group change and explicit BP session revocation.
• For email errors, check corporate claims in AD FS. For directory errors, check the approved route, CA and service account. Relinking a personal account does not resolve these configuration errors.