Managing Identity Providers

Article Type: Configuration / How-To
Audience: Enterprise Administrators
Module: Access Control
Applies to Versions: All Versions
Estimated Time: 30-45 minutes

1. Overview

Identity Providers control how users authenticate to the Fuuz platform. Enterprise Administrators configure Identity Providers to enable internal password-based authentication, Single Sign-On via OpenID Connect, or basic API authentication for specialized integration scenarios. Each Enterprise User is assigned to one Identity Provider, which determines their authentication method, password policies, multi-factor authentication settings, and IP-based access restrictions.

Identity Provider Types

Key Concepts

• Default Identity Provider: Automatically selected when creating new users; can be overridden during user creation
• One IdP Per User: Each Enterprise User is assigned to exactly one Identity Provider
• IP Restrictions: Applied at IdP level; all users of that IdP inherit IP whitelist restrictions
• Cost Optimization: Internal IdP avoids per-user licensing costs of corporate SSO providers for non-directory users
• Frontend vs API Access: Internal and OIDC users can access both frontend and API; Basic API Access users are API-only

Common OIDC-Compatible Providers

• Microsoft Azure AD / Entra ID: Enterprise directory and identity management
• Google Workspace: Google's enterprise identity platform
• Okta: Dedicated identity and access management platform
• Auth0: Developer-focused identity platform
• Keycloak: Open-source identity and access management
• Ping Identity: Enterprise identity platform
• AWS Cognito: Amazon's managed authentication service
• OneLogin: Cloud-based identity management

2. Prerequisites

• Access Level: Enterprise Administrator with Enterprise Admin Home access
• Permissions: Access Control management permissions
• Resources: For OIDC providers, administrative access to external identity platform (Azure AD, Okta, etc.)

3. Procedure Steps

Step 1: Configuring Internal Identity Provider

The Internal Identity Provider is pre-configured by default. Customize password policies and security settings as needed.

1. Navigate to Enterprise Admin → Access Control → Identity Providers
2. Select the Internal provider by clicking the Id field
3. Review the left panel Basic Information
4. Configure the middle panel Configuration section:
   • Verify Default checkbox status (should have one default IdP)
   • IP CIDR Whitelist: Add IP addresses or CIDR blocks to restrict login access (optional)
   • Minimum Length: Default 8 characters
   • Maximum Length: Default unlimited
   • Require Mixed Case: Force uppercase and lowercase characters
   • Require Number: Force at least one numeric character
   • Require Symbol: Force special characters
   • Expires In Days: Default 90 days; 0 = never expires
   • Require Multi-Factor Authentication: Enable Email or Mobile App 2FA
   • Prevent Password Reuse: Block reusing recent passwords
5. Review the right panel History section showing creation and modification audit trail
6. Save changes

Step 2: Configuring OpenID Connect SSO Provider

Configure Single Sign-On using OpenID Connect for corporate directory users.

Part A: Configure OIDC Application in External Identity Platform

Follow your SSO provider's documentation to create an OIDC application. Example for Azure Entra ID: https://entra.microsoft.com/

1. Navigate to Azure Entra ID admin center
2. Under Applications, select App Registrations
3. Click New registration
4. Enter application details:
   • Name: Fuuz
   • Supported account types: Accounts in this organizational directory only
   • Redirect URI: Platform: Web, URL: https://[EnterpriseID].fuuz.app/authentication/oidc
   • For non-production: https://[Environment].[EnterpriseID].fuuz.app/authentication/oidc
5. Click Register
6. Copy and save:
   • Application (client) ID
   • Directory (tenant) ID
7. Optional: Configure sign-in branding on Branding & Properties page
8. Switch to Authentication page:
   • Optional: Add front-channel logout URL: https://[EnterpriseID].fuuz.app/authentication/signout
   • Under Implicit grant and hybrid flows, check ID Tokens box
   • Click Save

1. Navigate to Enterprise Admin → Access Control → Identity Providers
2. Click + (Add) button
3. Complete the Create a new Identity Provider form:
   • Name: Descriptive name (e.g., "Azure Entra ID", "Okta SSO")
   • Default: Check if this should be default for new users
   • Identity Provider Type: Select OpenID Connect SSO
   • IP CIDR Whitelist: Add IP restrictions if needed (optional)
4. Click + (Submit)
5. Navigate to the newly created provider by clicking the Id field
6. Configure OIDC settings in the Configuration panel:
   • URL: Format: https://login.microsoftonline.com/[DirectoryID]/v2.0
   • Client ID: Application (client) ID from Azure configuration
   • Authentication Prompt: Select from dropdown:
     • login: Always prompt for credentials
     • consent: Prompt for user consent
     • select_account: Let user choose account
7. Save changes

Step 3: Configuring Basic API Access Provider

Create a Basic API Access Identity Provider for specialized API integrations where standard API Key length is too long for the external system to accept.

1. Navigate to Enterprise Admin → Access Control → Identity Providers
2. Click + (Add) button
3. Complete the Create a new Identity Provider form:
   • Name: Descriptive name (e.g., "Legacy System API Access")
   • Default: Leave unchecked (not typically default)
   • Identity Provider Type: Select Basic API Access
   • IP CIDR Whitelist: Add IP restrictions if needed (optional)
4. Click + (Submit)
5. Navigate to the newly created provider by clicking the Id field
6. Configure password policy settings in the Configuration panel:
   • Minimum Length: Set minimum password length; must be ≥ 32 characters
   • Maximum Length: Set maximum password length; must be ≤ 256 characters
   • Require Mixed Case: Force uppercase and lowercase characters
   • Require Number: Force at least one numeric character
   • Require Symbol: Force special characters
7. Save changes

Step 4: Assigning Users to Identity Provider

Assign Enterprise Users to the appropriate Identity Provider during user creation or by converting existing users.

Option A: Assign During User Creation

1. Navigate to System → Access Control → Enterprise Users
2. Click + (Add) to create new user
3. In Identity Provider field, select desired provider (defaults to Default IdP)
4. Complete remaining user details and submit

Option B: Convert Existing User

1. Navigate to System → Access Control → Enterprise Users
2. Locate user and click the Email column to open user form
3. Select Identity Providers tab
4. Select existing Identity Provider
5. Click Delete (trash can) button to disassociate current provider
6. Click + (Create) button to associate new provider
7. Select new Identity Provider from dropdown
8. Submit
9. Verify user receives new Account Created email with updated sign-in instructions

Option C: Manage from Identity Provider Interface

1. Navigate to Enterprise Admin → Access Control → Identity Providers
2. Select an Identity Provider by clicking the Id field
3. Click the USERS tab
4. View all users currently assigned to this Identity Provider
5. Select a user to edit their Identity Provider assignment

Step 5: Configuring Multi-Factor Authentication (Internal IdP Only)

Enable two-factor authentication for Internal Identity Provider users. MFA settings only apply to Internal IdP, not OIDC or Basic API Access providers.

Option A: Users Configure Their Own MFA

1. User navigates to My Account in Fuuz
2. Click Edit button in Security Settings section
3. Select 2FA method:
   • Email: Receive 6-digit code via email
   • Mobile App: Use authenticator app (Authy, Google Authenticator, Microsoft Authenticator)
4. For Mobile App, scan QR code or manually enter 32-digit code
5. Save changes

Option B: Enterprise Admin Configures MFA via Identity Provider

1. Navigate to Enterprise Admin → Access Control → Identity Providers
2. Select Internal Identity Provider by clicking the Id field
3. Navigate to USERS tab
4. Select user to configure
5. Click Edit
6. Select 2FA method (recommend Email when configuring for other users)
7. Save

Option C: Enterprise Admin Configures MFA via Enterprise Users

1. Navigate to System → Access Control → Enterprise Users
2. Locate user and click Email column to open user form
3. Navigate to Identity Provider tab
4. Select the Identity Provider
5. Click Edit
6. Select 2FA method
7. Save
   

4. Configuration Reference

Identity Provider Fields

Internal IdP Configuration

OIDC Configuration

Basic API Access Configuration

IP Restrictions

• Scope: Applied at Identity Provider level; all users of that IdP inherit restrictions
• Format: Individual IP addresses or CIDR blocks (e.g., 192.168.1.100 or 10.0.0.0/24)
• Quantity: Unlimited number of IP addresses or CIDR blocks
• Authentication Failure: Users authenticating from non-whitelisted IPs are immediately denied
• Layered Security: Works in conjunction with IP restrictions in Access Control Policies (IdP controls login; policies control screen/data access)

5. Validation & Testing

Success Criteria:

• ✓ Identity Providers configured with appropriate password policies and security settings
• ✓ For OIDC: External identity platform configured with correct redirect URI and ID token flow
• ✓ Test users successfully authenticate using each configured Identity Provider
• ✓ IP restrictions properly block authentication from non-whitelisted addresses
• ✓ MFA prompts when enabled; 6-digit codes validated correctly
• ✓ Password expiration triggers lockout; Enterprise Admin can reset

Testing Internal IdP

1. Create test user assigned to Internal Identity Provider
2. Verify user receives Account Created email
3. User sets password meeting configured policy requirements
4. User successfully logs into Fuuz
5. If MFA enabled, verify 2FA prompt appears and 6-digit code validates
6. Test password expiration by setting Expires In Days to 1 day; verify lockout after expiration

Testing OIDC IdP

1. Create test user assigned to OIDC Identity Provider
2. Navigate to Fuuz login page
3. Enter user email and click Continue
4. Verify redirect to external SSO provider
5. Authenticate with SSO credentials
6. Verify successful redirect back to Fuuz with user logged in
7. Test logout using Sign out everywhere link to verify front-channel logout

Testing Basic API Access

1. Create test user assigned to Basic API Access Identity Provider
2. Verify user can authenticate via API using username/password
3. Confirm user CANNOT log into Fuuz frontend
4. Verify user can only access Home Tenant configured during creation
5. Test password meets minimum 32 character requirement

Best Practices

• Strategic Planning: Design Identity Provider strategy before creating users to minimize manual conversion work
• Default IdP Selection: Set Internal as default; explicitly select OIDC for directory users during creation
• Password Policies: Align Internal IdP policies with corporate security standards
• IP Restrictions: Use for office locations with static IPs; avoid for remote workers with dynamic IPs
• MFA Configuration: Enable Email 2FA by default; allow users to opt into Mobile App 2FA
• Multiple IdPs: Create separate OIDC providers for different organizational divisions if different security policies required
• Documentation: Document which users should use which Identity Provider for consistent onboarding

6. Troubleshooting

7. Related Resources

• Managing Enterprise Users: Creating and managing user accounts including Identity Provider assignment
• Access Control Overview: Comprehensive overview of Fuuz access control model
• Authentication Events: Monitoring and troubleshooting authentication activity
• Managing API Keys: Alternative API authentication for programmatic integrations
• Access Types Explained: Understanding Administrator, Developer, Web Access, Gateway Access, and API Access types

8. Revision History