Authentication and Identity

Open identity settings

An administrator opens Settings → Authentication & identity. Choose LDAP / Active Directory for directory username/password authentication or OpenID Connect for identity-provider browser sign-in. These are separate from Open Client Area, which connects to the customer account service.

Keep a working local administrator session while changing authentication. Confirm the new sign-in flow in a separate browser session before depending on it.

Configure LDAP / Active Directory

1. Enter the LDAP URL, Base DN, Bind DN and bind password for the approved directory connection. Use an encrypted directory endpoint and its appropriate trust configuration.
2. Set the user filter and email, name and group attributes to match your directory.
3. Enter permitted staff email domains and explicit groups for Administrator, Operator, Network Operator and Read-only access.
4. Enable LDAP authentication, save settings, and verify sign-in with a pre-created account before enabling just-in-time provisioning.

Matching pre-created identities keep their assigned SSLNexus role. JIT staff provisioning is disabled by default and uses explicit configured groups. Network Operator mapping grants appliance-scoped access, not general platform administration.

Configure OpenID Connect SSO

1. Register an application with your chosen provider. Copy the Administrator redirect URL shown by SSLNexus into the provider application’s allowed redirect URLs. If using a separate Vendor Portal hostname, register the shown Vendor redirect URL as well.
2. Select Microsoft Entra ID, Okta, Google Workspace or Generic OIDC. Enter the required tenant or issuer, Client ID and Client secret; use a discovery override only when required by your provider.
3. Choose scopes and enable the intended Administrator and/or Vendor portal access. Configure staff and vendor email domains and any Google Workspace hosted-domain boundary.
4. Map provider groups to SSLNexus roles. Decide whether to permit JIT staff provisioning and require MFA evidence from the provider. Save settings and test sign-in with the intended account.

SSLNexus validates signed ID tokens, issuer, audience, expiry and nonce before issuing its own session. Provider group and MFA claims must match the selected configuration. Vendor SSO does not create a new vendor assignment: its email must already belong to an enabled vendor identity.

Confirm role and recovery access

Review Team Access and Network Operator role assignment. Confirm both successful sign-in and the resulting access scope. If sign-in fails, check the exact redirect URL, issuer, provider discovery, account email and group claims before broadening permissions.