Identity providers - Asset Infinity

The Identity providers screen is where you connect the identity provider or directory your organisation already runs, so your people sign in with the credentials you manage there rather than with a password held in this product. Open it from Administration → Integrations → Identity providers, or from the Authentication screen. It is the administration side of ways to sign in: what you configure here decides which buttons and forms your people see on the sign-in screen, and what happens when they use them. Password rules, lockout and session length stay on Authentication.

The Identity providers screen with a new SAML connection open

The screen at a glance

The header carries three figures:

Figure	What it counts
connections	Every connection saved for this organisation, in use or not
in use	Connections whose In use switch is on, so they are offered on the sign-in screen
signing in through them	Accounts that have signed in through any of the connections at least once

Add a connection opens an empty connection panel below the list. You see it only if you can configure sign-in (see who can use this). Everybody else sees a notice saying they can read the connections but not change them.

The connections list

Click a row to open that connection’s panel underneath.

Column	What it shows
Connection	The button label, with the connection’s URL name underneath
Protocol	SAML 2.0, OpenID Connect or LDAP
In use	In use when people are offered it, Off when they are not
Passwords	still work when people may also sign in with a password set here; Only way in when passwords are switched off for this connection
Certificate	For SAML, the soonest expiry date among the certificates in use, or a red None (every sign-in is refused until you add one). For LDAP, a dash unless you have pinned your own certificate authority. Always a dash for OpenID Connect, whose signing keys are fetched from the issuer
Signing in	How many accounts sign in through this connection
Last used	When somebody last signed in through it, or never

With no connections, the list says No identity provider yet: everybody signs in with a password set in this system.

Choosing a protocol

Protocol	Use it for	How somebody signs in
SAML 2.0	An identity provider your organisation runs: Microsoft Entra ID, ADFS, Okta, Google Workspace and similar	They are redirected to the identity provider and come back with a signed assertion
OpenID Connect	An identity provider that speaks OIDC, including Entra ID, Okta, Auth0 and Keycloak	They are redirected to the identity provider and come back with a signed token
LDAP / Active Directory	A directory behind your own firewall with no identity provider in front of it	They type their directory password into this product’s own sign-in form, and it is checked against your directory. Nothing redirects

The protocol is chosen when the connection is created and cannot be changed afterwards. To move from one protocol to another, add a second connection.

Nothing is switched on by saving it. A connection is saved with In use off. Configuring SAML or OpenID Connect is a two-way exchange — values from your identity provider into this form, and values from this form back into theirs — so nobody is offered the connection until you have finished both halves, tested it and switched it on. Saving never signs anybody out; the banner after a save says so.

The connection panel

The panel is a set of sections. Which ones appear depends on the protocol and on whether the connection has been saved yet.

Section	SAML 2.0	OpenID Connect	LDAP
The last refusal (a red banner)	When the last sign-in was refused	When the last sign-in was refused	When the last sign-in was refused
Whether it works	—	—	Once saved
Windows sign-in	—	—	Once saved
What to give your identity provider	Once the URL name is filled in	— (the redirect URI is inside Your issuer)	—
This connection	Always	Always	Always
Your identity provider / Your issuer / Your directory	Your identity provider	Your issuer	Your directory
Reading the assertion / Reading the entry	Reading the assertion	Reading the assertion	Reading the entry
Who gets an account	Always	Always	Always
Whether a password still works	Always	Always	Always
Signing certificates / Certificate authorities	Once saved	—	Once saved
Which groups grant which roles	Once saved	Once saved	Once saved
Provisioning (SCIM 2.0) and Setting provisioning up in your directory	Once saved	Once saved	Once saved
Read accounts from this directory	Once saved	Once saved	Once saved

At the bottom, Create connection (or Save connection for a saved one) saves every section of the form at once. Close discards unsaved changes. Delete connection removes a saved one; if accounts sign in through it, a line under the buttons says how many, because accounts created through a connection have no password and deleting it removes their only way in.

The last refusal

When your identity provider or directory last refused somebody, the panel opens with a red banner: The last sign-in through this connection was refused: followed by the reason and when. The commonest causes are an expired signing certificate, a clock difference, or a value copied with a character missing. This banner is the answer to “is it us or is it them” while you have your identity provider team on the phone.

This connection

Field	What it means	Notes
URL name	A short permanent name that appears in every address this connection uses, such as `northwind-adfs`	Required. 2 to 30 lowercase letters, digits and hyphens, starting with a letter or digit. The box warns you while you type if the name is not allowed, and Create connection stays disabled until it is. Fixed once the connection is saved: changing it would mean re-registering with your identity provider
Button label	What the sign-in screen calls this connection, such as “Northwind SSO”	The only text most of your people will ever see about how they sign in. Choose words they recognise
Protocol	SAML 2.0, OpenID Connect or LDAP / Active Directory	Defaults to SAML 2.0. Fixed once saved. For LDAP, a hint explains that people type their directory password into this app
In use	Whether people are offered this connection on the sign-in screen	Off by default. Leave it off until you have tested the connection. While it is off, nothing about your existing sign-in changes

Setting up SAML 2.0

What to give your identity provider

As soon as the URL name is filled in, a section at the top of the panel shows the values your identity provider needs when you register this application with it. Each has a copy button.

Value	What it is
Entity ID (audience)	The name your identity provider must issue its assertions for. Ends in `/auth/saml/<URL name>/metadata`
Reply URL (ACS)	Where your identity provider posts the signed assertion. Ends in `/auth/saml/<URL name>/acs`
Our metadata	The same address as the entity ID. Most identity providers can read everything they need from it. It is available once the connection is saved and switched on

Use the copy buttons rather than typing. These addresses differ from each other by one segment, and a single wrong character produces a connection that refuses every assertion as “issued for a different application”.

Your identity provider

Field	What it means	Notes
Metadata URL	Where your identity provider publishes its SAML metadata document	Optional but recommended. Read metadata (or Refresh from metadata on a saved connection) fetches it and fills in the three fields below and the certificates. Metadata last read shows when it was last read
Metadata file	The metadata XML, pasted or chosen from your computer	Appears when you click Paste the file instead. Use it when this product cannot reach your identity provider: one behind a firewall, behind a sign-in, or on a certificate from your own authority. Read this file or Choose a file… reads it. Nothing is sent to your identity provider
IdP entity ID	The issuer your identity provider puts in its assertions	Compared character for character, so copy it exactly. Filled in by a metadata read
IdP sign-in URL	Where people are sent to sign in. Metadata calls it the SSO or redirect endpoint	Filled in by a metadata read
IdP sign-out URL	Where people are sent when they sign out	Optional. Left empty, signing out ends the session here only, and the next visit signs straight back in through your identity provider
Clock tolerance	How many seconds your identity provider’s clock may differ from this product’s	Default 120 (two minutes), which suits a domain-joined identity provider. Raise it only if you actually see clock refusals

When a metadata read changes a value the connection already had saved, the hint under that field says Changed by the metadata. This connection had … so you can see what moved before you save. A metadata read can also show two warnings:

Warning	What to do
Your IdP only offers sign-in by HTTP-POST	This product sends people to your identity provider by redirect. Ask your identity provider team to enable the HTTP-Redirect binding, then read the metadata again
Your IdP says it wants signed sign-in requests	This product sends sign-in requests unsigned. Turn that requirement off for this application at your identity provider, or it refuses every sign-in

Certificates found in the metadata

Under the form, a metadata read lists Signing certificates in this metadata, each with its SHA-256 fingerprint, subject and expiry, and a state:

State	Meaning
In use	Already trusted here. Nothing to do
Retired	Known here but taken out of use on purpose. Left unticked so a read does not quietly bring it back
New	Not known here. Ticked, because a new certificate in the metadata is almost always the start of a rotation
Expired	Past its expiry date

Ticking is not trusting: ticked certificates are trusted only when you save. Check each fingerprint against what your identity provider shows before you do. Below the list, any certificate still in use here that the identity provider no longer publishes is offered with a Retire button. It is not retired automatically, because identity providers usually stop publishing a certificate a little before they stop signing with it. If the metadata publishes no signing certificate at all, the screen says so. Paste one in the Signing certificates section once the connection is saved, or nobody can sign in through it.

Setting up OpenID Connect

Your issuer

Field	What it means	Notes
Issuer URL	Your identity provider’s issuer, exactly as it publishes it	Compared character for character against the token
Client ID	The ID of the application you registered with your identity provider
Client secret	The secret of that application	Stored encrypted and never shown again. Once one is stored, the hint shows its last few characters; leave the box empty to keep it
Discovery URL	Where the identity provider’s OpenID configuration document is	Usually the issuer with `/.well-known/openid-configuration` on the end. Left empty, that is what is tried
Scopes	The scopes requested when somebody signs in	Defaults to `openid email profile`, which covers a name and an email address. Add whatever scope your identity provider needs before it sends group membership
Redirect URI	The address your identity provider sends people back to	Read-only, with a copy button. Ends in `/auth/oidc/<URL name>/callback`. Register it with your identity provider exactly as written

Setting up LDAP / Active Directory

Your directory

Field	What it means	Notes
Directory URL	Scheme, host and port of your directory, such as `ldaps://dc1.example.local:636`	Point it at a name your DNS resolves to whichever domain controller is up
Upgrade to TLS	Ask a plain `ldap://` directory to encrypt the connection (StartTLS) before anything is sent	Shown only when the address does not start with `ldaps://`, which is encrypted from the first byte. Off by default
Send passwords unencrypted	Allow passwords to cross the network in the clear	Shown only when the address is not `ldaps://` and Upgrade to TLS is off. Only for a directory that can do neither. Turning it on is recorded against your name and shows a red warning
Service account	The account this product searches your directory as: a read-only account’s DN, or its user principal name on Active Directory	Leave empty for an anonymous search, or when you use a DN template
Service account password	That account’s password	Stored encrypted and never shown again. Once stored, the hint shows its last few characters; leave the box empty to keep it
Where people are	The branch searched for the person signing in, such as `OU=People,DC=example,DC=local`	Also required for reading accounts from the directory
How to find them	The search filter that finds the person signing in	`{{login}}` is what they typed and `{{username}}` the part before the @. Empty uses a default that matches on `mail` and `userPrincipalName`. Narrow it if the same branch holds contacts or disabled accounts
DN template	Build the person’s DN from what they typed instead of searching, such as `uid={{username}},ou=people,dc=example,dc=com`	Filled in, no service account is needed at all, which is the safer arrangement where your DNs are predictable
Immutable ID attribute	The attribute that identifies somebody for good	Empty tries `objectGUID`, then `entryUUID`, then `uid`, then their DN. Avoid relying on the DN: it changes when somebody moves department, which would bring them back as a new account
Timeout	Seconds to wait for your directory	Default 10, which suits a controller on the same network

Prefer ldaps:// or StartTLS. Sending passwords unencrypted is possible for a directory that can do neither, but every password then crosses your network in the clear — including from handsets on site wifi — and these are your people’s real directory passwords. If your controller’s certificate comes from your own certificate authority, pin that authority in Certificate authorities rather than turning encryption off.

Whether it works

An LDAP connection has no console of its own to test from, so once it is saved a Whether it works section appears at the top of the panel. Save and test saves the connection first (the test always uses the saved values) and then tries it. It reports each step it got through rather than a bare pass or fail — reached the address, negotiated encryption, the service account was accepted, the search found somebody — with a tick or a cross beside each. It never asks for or checks anybody’s own password. The last line is the verdict: This connection reached your directory. Switch it on when you are ready. or This connection is not working yet. Nobody is being offered it while it is switched off. Editing any field clears the report, because it described the values that were saved when it ran. A saved LDAP connection also has a Windows sign-in section. With it set up, people already signed in to Windows on a PC in your domain go straight in when they open the address you name here, with no password. Each time, your directory is asked whether their account is still enabled, and they also need an active account in this organisation. Anybody else sees the usual sign-in screen. Windows sign-in finds people by their Windows account name, so the connection needs a branch to search under (Where people are) rather than a DN template. Without one the section says so and cannot be filled in.

Field	What it means
Address people open	The full name of this product on your network, exactly as the service principal names it — for example `assets.northwind.local`. Leave it empty to switch Windows sign-in off
Keytab	The file `ktpass` writes for the service account that holds `HTTP/` followed by the address above, with AES 256 encryption. Choose the keytab picks the file. Once one is uploaded, the hint says when, and the button reads Replace the keytab

Save Windows sign-in saves this section on its own, separately from the rest of the connection. This screen cannot tell whether the keytab is right, so run Save and test under Whether it works afterwards and then open the address on a domain PC. People added with Add from your directory are linked to their directory entry, which is what Windows sign-in matches first.

Reading the assertion or the entry

These fields say where in the assertion (SAML and OpenID Connect) or the directory entry (LDAP) the person’s details are found. Leave them empty and the usual places are tried: the NameID and the standard SAML and OpenID Connect claims, or for LDAP mail, givenName, sn and memberOf.

Field	What it means	Notes
Email attribute	Where the email address is	An email address is how an account is recognised here, so it must arrive
First name attribute	Where the first name is
Surname attribute	Where the surname is
Groups attribute	Where the person’s group membership is	Without it, group mapping has nothing to read and everybody arrives with the default role. Entra ID sends group object IDs unless you configure the claim to send names, so check what actually arrives. For LDAP, empty means `memberOf`, which is where Active Directory keeps it

Who gets an account

Field	What it means	Notes
Create accounts on first sign-in	Whether somebody your identity provider vouches for, who has no account here, gets one automatically	Off by default. Off, they are refused until an administrator invites them on Access
Default role	The role somebody gets when no group mapping matches	Defaults to Nothing at all. Choose the narrowest role that is still useful: this is what an unmapped stranger arrives holding. The list is the organisation’s active roles
Allowed email domains	Which email domains this connection accepts, comma separated, such as `example.com, example.co.uk`	Subdomains are included. Empty means any address your identity provider asserts — which matters most with account creation on and a multi-tenant identity provider

Whether a password still works

Field	What it means	Notes
Passwords still work (Passwords set here still work on LDAP)	Whether people may still sign in with a password held in this product	On by default. Turn it off once the connection works, and this organisation’s people can only sign in through it. Until you do, disabling somebody in your directory does not stop them signing in here with their old password. On LDAP people still type a password, but it is checked against your directory rather than against anything stored here
Break-glass role	The one role that may still sign in with a password when your identity provider or directory is unreachable	Appears when passwords are switched off. Give the role to two or three named people, not to a group. Every such sign-in raises a notification and an audit record

When passwords are off, a warning reminds you that an outage at your identity provider then stops everybody signing in except the break-glass role. Test the connection before you save, and make sure somebody who is around today holds that role.

Signing certificates and certificate authorities

This section appears once a SAML or LDAP connection is saved, and means a different thing for each.

Protocol	What the list holds
SAML 2.0 — Signing certificates	The certificates assertions are checked against. A SAML connection with none can verify nothing, so every sign-in through it is refused. Several may be in use at once, which is what makes a rotation survivable: add the new certificate before the old one expires, and assertions signed with either are accepted
LDAP — Certificate authorities	Needed only if your controller’s certificate is issued by your own certificate authority. Pin that authority here and it becomes the only one this connection accepts, which is stricter, not looser. With the list empty, the usual public authorities are trusted

Column	What it shows
Fingerprint (SHA-256)	The first characters of the fingerprint; hover for all of it
Subject	The certificate’s subject
Expires	The expiry date, or a red expired pill
In use	In use or Retired

Retire on a row takes that certificate out of use. To add one, paste its base64 block (with or without the BEGIN CERTIFICATE lines) into Add a certificate and click Add certificate. Check the fingerprint against what your identity provider or certificate authority shows before you rely on it.

Which groups grant which roles

Once a connection is saved, you can map groups in your directory to roles here. Mappings are applied on every sign-in, not only the first, and they take roles away as well as granting them: somebody who moves out of a group in your directory stops holding the role here. Only roles named in a mapping are touched; anything granted by hand on Access is left alone. Search groups and roles finds a mapping by its group or role, and the filter button beside it narrows the list by either column.

Column or field	What it means
Group in your directory	The group name exactly as your identity provider sends it
Role here	The role it grants
Group (to add one)	The group name to map
Role (to add one)	The role to grant, from the organisation’s active roles. Map adds the mapping; the bin icon removes one

With no mappings, everybody arriving through this connection gets the default role and nothing else. For LDAP, three more settings sit above the table, for directories that record membership on the group rather than on the person (OpenLDAP’s groupOfNames and posixGroup). Active Directory needs none of them.

Field	What it means	Notes
Where groups are	The branch to search for groups, such as `OU=Groups,DC=example,DC=local`
How to find their groups	The search filter for a person’s groups	`{{dn}}` is the person’s DN, `{{uid}}` their immutable ID and `{{username}}` the part of their address before the @. Use `{{uid}}` for `posixGroup`, whose `memberUid` holds a name rather than a DN
Follow nested groups	Active Directory only. Somebody in a group that is itself inside a mapped group holds that mapping’s role	Off by default: only direct membership counts. If you have also written your own group filter, the switch does nothing and a warning says so

On LDAP a group can be matched by its name or its whole DN. Use the full DN where two branches hold groups with the same name.

Directory provisioning

Group mapping covers arrival: somebody signs in and gets the roles their groups say. What it cannot cover is departure — your directory knows somebody has left and this product does not, until they next try to sign in or until somebody remembers to deactivate them. There are two ways to close that gap, and you need only one.

Way	Use it when
Provisioning (SCIM 2.0)	Your identity provider can push changes (Entra ID, Okta and most others). It tells this product the moment somebody is disabled
Read accounts from this directory	Your directory cannot push — no SCIM licence, or an on-premises LDAP directory. This product reads it on a schedule instead

Provisioning (SCIM 2.0)

Item	What it is
SCIM base URL	The address to paste into your identity provider’s provisioning connector, ending in `/scim/v2`. Paste this address itself, not a path under it: your identity provider adds `/Users` and `/Groups`
Name a new token	A name for a token, such as the identity provider it is for. Issue token creates it

When you issue a token, a panel shows it once: Copy this now — it is not shown again. This product keeps only a hash and the last six characters, so nothing can read it back. Paste it into your identity provider, then click I have copied it. If it is lost, revoke it and issue another. The token list shows:

Column	What it shows
Token	Its name and the last six characters
Requests	How many requests it has made and when it was last used, or Never used — the usual sign of a connector that was never finished at the identity provider’s end
State	Live, Expired or Revoked

The bin icon revokes a token. If any token has been refused, a Last refusal: banner shows why. Once your identity provider has pushed groups, a table lists them with Group (exactly as it arrived, which is what mappings match on), People (members) and Grants (the roles it grants here, or Nothing — not mapped). Use it to copy group names into the mapping table. When your directory disables somebody, their sessions here end and their next request is refused. Setting provisioning up in your directory gives step-by-step instructions for Microsoft Entra ID and Okta, with the values to paste, to send to whoever administers your directory. Two things it calls out: Entra ID provisions only the people and groups assigned to the application, and Okta ships Deactivate Users switched off — leave it off and nothing happens when somebody leaves.

Reading accounts from a directory

Read accounts from this directory reads your directory on a schedule and creates, updates and deactivates accounts to match it.

On an LDAP connection it binds as the connection’s service account and reads everybody the search matches, under Where people are. Your directory has no way of saying that somebody has left, so anyone the read no longer finds is treated as gone — which is why there is a deactivation limit.
On a SAML or OpenID Connect connection to Microsoft Entra ID it uses the connection’s own client ID and secret, which needs your app registration to be granted User.Read.All. No SCIM licence is needed.

If something stops the read from working, a warning says what to fill in first: Where people are for an LDAP connection that signs people in with a DN template, or a client ID and secret for the other two.

Field	What it means	Notes
Read this directory on a schedule	Whether the scheduled read runs	Off by default, and disabled until the connection can be read. Leave it off until you have filled in the fields and run a dry run: a half-configured read that runs is one that deactivates people
Who to read	LDAP only. The search that finds everybody this read maintains	Empty uses a default that matches people with an email address
Directory (tenant) ID	SAML and OpenID Connect only. The Directory (tenant) ID from your app registration’s overview page	A GUID
How often (minutes)	How often the read runs	Default 60. Between 5 and 10080 (a week). Only changes since last time are asked for, so frequent reads are cheap, but every read counts against your directory’s quota
Deactivate at most	LDAP only. How many accounts one read may deactivate	Default 20. A read that would deactivate more deactivates nobody and lists who it meant, so a mistyped search cannot empty your organisation overnight

Save schedule saves these. What would this do? runs a dry run: it decides everything and writes nothing, so you can read the result first. Read it now runs a real read straight away. Either is queued and usually picked up within a minute; a line under the buttons says when the directory was last read and when it is next due. Every read is listed:

Column	What it shows
Read	When it started, and Dry run, Scheduled or who started it
Outcome	How many accounts were created, updated, deactivated and refused, or Nothing had changed
State	Done, Some refused, Failed or In flight

Decisions opens one read’s decisions, refusals first, with Person, Decision (Created, Updated, Reactivated, Deactivated, No change or Refused) and Why:

Reason given	Meaning
Your directory sent no email address for them	An address is how an account is recognised here
Their address is not in this connection’s allowed domains	Usually guests and contractors in your directory
Somebody here already has that address	Their account was left alone rather than merged with a stranger’s
More people missing than it is allowed to deactivate	The deactivation limit was reached, so nobody was deactivated. Check the search before raising the limit
One of the values is longer than this product stores	Shorten it in your directory

If a read could not reach the directory at all, The last read failed: shows the reason.

Who can use this

To	You need	Default
See the connections	Access to Administration	System Administrator
Add, change, test and delete connections; issue and revoke SCIM tokens; configure directory reads	The permission Configure the sign-in policy, identity providers and end sessions	System Administrator

Provisioning sits behind the same permission as the connection itself, because a token that can create and disable accounts is the same decision as connecting the directory. See roles.

Ways to sign in

What your people see on the sign-in screen once a connection is in use.

Authentication

Password rules, lockout, session length and who is signed in now.