Portal Identity And Trust Administration

Purpose

This functional area manages identity trust relationships used by both portal authentication and runtime authorization.

It defines how external identities are recognized, translated, restricted, and linked to tenant-aware platform behavior across separate Security pages in the Portal.

Main Capabilities

• manage trusted identity providers
• manage external identity providers
• manage claim mapping profiles
• manage external tenant allow-lists
• manage per-tenant external provider configuration
• manage external provider tenant assignments

The current Portal Security navigation exposes these capabilities through distinct entries:

• External Identity Providers at /security/external-identity-providers
• Trusted Identity Providers at /security/trusted-identity-providers
• Claim Mapping Profiles at /security/claim-mapping-profiles

Trusted Identity Providers

Trusted identity providers are used to define which external issuers the platform can trust for authenticated runtime or security-relevant flows.

This page is focused on provider trust configuration only. Claim translation rules are managed separately through the Claim Mapping Profiles page.

Functionally, administrators can configure:

• issuer identity
• authority or metadata source
• allowed audiences
• allowed client IDs
• claim mapping behavior
• enabled/disabled state

The list can be searched by name or issuer, and each provider's detail view groups its configuration into identity, connection, signing key, and claim mapping profile sections for easier review.

One provider — the built-in platform issuer used for device flow and web session authentication — is a system-managed record. It is marked with a "System" badge and cannot be edited or deleted from this page; it is maintained automatically by the platform.

External Identity Providers

External identity providers are used for portal sign-in flows using the OIDC Authorization Code + PKCE standard.

Supported provider types include:

• Microsoft Entra ID
• Keycloak

This area controls:

• login provider registration
• provider type selection
• provider enablement
• metadata discovery and connection testing during setup
• portal-facing display behavior
• tenant-aware provider behavior
• eligibility controls such as domains, groups, app roles, and audiences

Claim Mapping Profiles

Claim mapping profiles translate incoming identity claims into the platform’s functional identity model.

They are managed on a dedicated Security page so administrators can work on claim translation separately from trusted issuer administration.

They define how the platform derives:

• subject identity
• username
• email
• tenant identity
• roles
• scopes
• groups
• client identity

This is essential for turning external tokens into meaningful platform authorization context.

The list can be searched by name (server-side, debounced as you type) and filtered by status, and each profile's detail view groups its configuration into Identity, Core claims, Membership claims, and Additional claims sections, with role/scope/group claims shown as badges instead of raw values.

One profile — the seeded "default" global profile — is a system-managed record. It is marked with a "System" badge and cannot be edited or deleted from this page; it is maintained automatically by the platform.

Tenant-Aware Identity Configuration

The Portal supports tenant-specific identity behavior through:

• provider-to-tenant assignments
• default provider designation within a tenant assignment set
• per-tenant provider configuration overrides
• external tenant allow-list entries

This lets the same platform host multiple organizations while keeping identity behavior governed per tenant.

Operational Importance

This area makes it possible to integrate enterprise identity safely without losing tenant isolation, auditability, or claim-level control.