Sign in
Stable

Sign in with your corporate IdP

Connect Keycloak, Okta or a compatible OIDC provider. Users sign in with corporate SSO, accounts are created on first login and access groups come from your IdP.

Steps

Follow these in order.

  1. 01One familiar sign-in for work accessA new employee or contractor does not need a separate BusinessProxy password. They choose SSO, authenticate at the corporate IdP and receive a BusinessProxy session only after OIDC state, nonce, issuer, audience and token lifetime are validated.
  2. 02Groups arrive from the identity sourceIdP group attributes can be mapped to workspace groups, including controlled auto-create behavior. Those workspace groups then decide which private apps a user can launch.
  3. 03OIDC is live; lifecycle provisioning is not yet SCIMBusinessProxy supports OIDC today. SAML SSO, scheduled directory sync and automatic deprovisioning without a later login are not part of the current delivery unless they are explicitly included in your rollout.

Reference

Implementation details for setup and review.

Identity and group mappingBusinessProxy becomes one more controlled business application in your identity stack. Teams sign in through the IdP they already use, while workspace membership and app groups are created from the OIDC attributes you approve.
  • Workspace-scoped IdP connections
  • Keycloak, Okta and generic OIDC
  • JIT account creation
  • IdP groups mapped to app access
One familiar sign-in for work accessA new employee or contractor does not need a separate BusinessProxy password. They choose SSO, authenticate at the corporate IdP and receive a BusinessProxy session only after OIDC state, nonce, issuer, audience and token lifetime are validated.
  • Reference Keycloak flow: Keycloak is the reference provider for sign-in, group attributes and disabled-connection checks.
  • Okta through OIDC: Okta has a dedicated OIDC provider profile with the expected issuer, scopes and group-attribute settings.
  • Generic compatible IdP: Compatible providers use discovery, JWKS, client ID/secret and RS256 ID-token validation.
Groups arrive from the identity sourceIdP group attributes can be mapped to workspace groups, including controlled auto-create behavior. Those workspace groups then decide which private apps a user can launch.
  • Each IdP connection belongs to one workspace.
  • JIT can create the local account and workspace membership on first successful SSO sign-in.
  • A disabled connection stops issuing sessions.
  • Audit events keep safe metadata, not raw IdP tokens.
OIDC is live; lifecycle provisioning is not yet SCIMBusinessProxy supports OIDC today. SAML SSO, scheduled directory sync and automatic deprovisioning without a later login are not part of the current delivery unless they are explicitly included in your rollout.
  • SAML SSO is not included in the current delivery.
  • SCIM deprovisioning is not included in the current delivery.
  • Provider compatibility is validated before rollout.