Reference Keycloak flow
Keycloak is the reference provider for sign-in, group attributes and disabled-connection checks.
Identity and group mapping
Sign in with your corporate IdP
BusinessProxy becomes one more controlled business application in your identity stack. Teams sign in through the IdP they already use, while workspace membership and app groups are created from the OIDC attributes you approve.
OIDC is supported today. SAML and SCIM lifecycle provisioning are planned separately, so they should be discussed before an enterprise rollout that depends on them.
Workspace-scoped IdP connectionsKeycloak, Okta and generic OIDCJIT account creationIdP groups mapped to app access
User experience
One familiar sign-in for work access
A new employee or contractor does not need a separate BusinessProxy password. They choose SSO, authenticate at the corporate IdP and receive a BusinessProxy session only after OIDC state, nonce, issuer, audience and token lifetime are validated.
Okta through OIDC
Okta has a dedicated OIDC provider profile with the expected issuer, scopes and group-attribute settings.
Generic compatible IdP
Compatible providers use discovery, JWKS, client ID/secret and RS256 ID-token validation.
Access model
Groups arrive from the identity source
IdP group attributes can be mapped to workspace groups, including controlled auto-create behavior. Those workspace groups then decide which private apps a user can launch.
- Each IdP connection belongs to one workspace.
- JIT can create the local account and workspace membership on first successful SSO sign-in.
- A disabled connection stops issuing sessions.
- Audit events keep safe metadata, not raw IdP tokens.
Current boundary
OIDC is live; lifecycle provisioning is not yet SCIM
BusinessProxy supports OIDC today. SAML SSO, scheduled directory sync and automatic deprovisioning without a later login are not part of the current delivery unless they are explicitly included in your rollout.
- SAML SSO is not included in the current delivery.
- SCIM deprovisioning is not included in the current delivery.
- Provider compatibility is validated before rollout.
Next step
Review the rollout details before turning it on
The documentation page shows what to configure, how to verify the setup and which operational boundaries to review before rollout.