Authentication on

Google

Mon, 01 Jan 0001 00:00:00 +0000

Create OAuth Client

Note: The instructions in this section are only needed when Google is used for authentication of the Atolio web application.

Create a new project in the Google Cloud Console by visiting https://console.cloud.google.com/cloud-resource-manager and clicking CREATE PROJECT. Provide a project name (e.g. Atolio) and select the correct Organization and Location. Note the Project ID field displayed below the Project name. You’ll need this value when setting up Terraform later. Click CREATE.

Keycloak

Mon, 01 Jan 0001 00:00:00 +0000

Configure Keycloak as your identity provider for user authentication. Atolio signs users in using the OpenID Connect authorization code flow against a client you create in your Keycloak realm.

Create OIDC Client

Note: The instructions in this section are only needed when Keycloak is used for authentication of the Atolio web application.

Sign in to the Keycloak admin console and select the realm your users authenticate against from the realm selector in the top-left.
Navigate to “Clients” and click “Create client”.
Leave “Client type” set to “OpenID Connect”, enter a “Client ID” (e.g. atolio), and click “Next”.
Turn on “Client authentication” so the client is confidential and issues a client secret. Leave “Standard flow” enabled under “Authentication flow”; the other flows are not required. Click “Next”.
Under “Valid redirect URIs”, add https://search.example.com/auth/_callback (replace search.example.com with your actual Atolio deployment URL; contact your Atolio onboarding support team if you need clarification on the correct URL).
(Optional) Set “Valid post logout redirect URIs” and “Web origins” to https://search.example.com to scope sign-out and CORS to your deployment.
Click “Save”.
Open the “Credentials” tab and copy the “Client secret”. Save it for later.

The profile and email scopes are part of Keycloak’s default client scopes, so the realm already returns the claims Atolio needs. No custom scope or mapper configuration is required.

Microsoft Entra ID

Mon, 01 Jan 0001 00:00:00 +0000

Configure Microsoft Entra ID as your identity provider for user authentication. This App Registration is specifically for authentication purposes and user/group identity mapping.

Create New App Registration

Authenticate to the Azure Portal via your Microsoft Identity.
Head over to App Registrations.
Click “New Registration”:
- Enter “Atolio Authentication” for the name.
- Ensure “Accounts in this organizational directory only” is selected from Supported account types.
- Add a redirect URI https://search.example.com/auth/_callback (replace search.example.com with your actual Atolio deployment URL - contact your Atolio onboarding support team if you need clarification on the correct URL).
- Click “Register”.
You should now be on the page of your new app registration. In the Essentials blade, locate the “Add a certificate or secret” link.
Create a Client Secret for use with OIDC:
- Select the “Client Secrets (0)” tab.
- Click “New Client Secret”.
- Enter “Atolio OIDC Authentication” for the description.
- Set desired expiry. Follow internal procedures for rotation.
- Copy the newly created “Value” of the Client Secret and store it in a safe place (e.g. 1Password). This will be referenced later for OIDC configuration.
Add a certificate for client authentication:
- Obtain a .PFX file that includes the public and private keys. The certificate key algorithm must be RSA. A private key password is optional, but recommended.
- Export the public key to a .CER file.
- Select the “Certificates (0)” tab.
- Click “Upload certificate”.
- Enter “Atolio Client Authentication” for the description.
- Select the .CER file and select “Add”.
- Export the .PFX file contents to base 64 and store it in a safe place (e.g. 1Password). You can obtain the base 64 encoding from the command line with cat my-cert.pfx | base64. This value will be referenced later for source configuration.
Add Microsoft Graph API Permissions:
- In your App Registration, click “API permissions” in the left menu
- Click “Add a permission”
- Select “Microsoft Graph”
- Click “Application permissions” (not Delegated permissions)
- Add these permissions:

Permission	Purpose
`Application.Read.All`	Resolve service principals and applications
`Group.Read.All`	List Microsoft 365 and security groups
`GroupMember.Read.All`	Resolve group membership for ACL mapping
`User.Read.All`	Resolve user objects and properties
`Directory.Read.All`	Extended directory objects (optional*)

*Optional: You can omit Directory.Read.All and set disable_full_permissions: true in your configuration for more restrictive access.

Okta

Mon, 01 Jan 0001 00:00:00 +0000

Create OAuth Client

Note: The instructions in this section are only needed when Okta is used for authentication of the Atolio web application.

Navigate to Applications in the Okta admin console (https://example.okta.com/admin/apps/active).
Click “Create App Integration”.
Select “OIDC - OpenID Connect” from the list of Sign-in methods.
Select “Web Application” from the list of Application types and hit “Next” to create the app.
(Optional) Edit the name and provide the Atolio logo for the app.
Under “Grant type” –> “Client acting on behalf of a user”, ensure that “Authorization Code” is enabled.
Under “Sign-in redirect URIs”, add the URL https://search.example.com/auth/_callback (note this is identical for Google).
Under “Sign-out redirect URIs”, remove the default http://localhost:8080 URI.
Under “Assignments”, choose who should have access to the Atolio app. This setting can be modified later. If you choose to “Skip group assignment for now”, remember to add yourself to the Assignments list in order to be able to sign-in.
Click “Save”.
Under “Client Credentials”, copy the “Client ID” & “Client Secret” and save them for later.

Setup Okta Connector

Once your Atolio infrastructure has been deployed, you will also need to setup the Okta Connector to enable users and user mappings using an API token.