Okta and other OpenID Connect providers

Overview

Cloudraw connects to any identity provider that supports OpenID Connect (OIDC) with the authorization code flow and a client secret. Your people sign in at your provider with the account and MFA you already manage there.

In Settings→Identity & SSO→Your identity provider you can choose:

What Cloudraw needs from every provider:

• A confidential web client (client ID plus client secret) using the authorization code flow.
• The scopes openid, profile and email.
• An https issuer URL with a working discovery document at <issuer>/.well-known/openid-configuration.
• A verified e-mail address for every user. Users whose e-mail is not verified at the provider are refused with "Your email address is not verified with your identity provider".

Step 1. Copy the redirect URI from Cloudraw

In the Cloudraw admin console open Settings→Identity & SSO, turn on Workspace sign-in if needed, and copy Redirect URI (add this at your provider). It looks like:

Step 2a. Okta: create the app integration

1. Create the integrationIn the Okta Admin Console go to Applications→Applications→Create App Integration. Choose OIDC - OpenID Connect and Web Application.
2. General settingsName: Cloudraw. Grant type: Authorization Code only.
3. Sign-in redirect URIRemove the example and paste the Cloudraw redirect URI. Leave the sign-out redirect empty.
4. AssignmentsChoose Limit access to selected groups and pick the groups that should use Cloudraw, or assign people later on the Assignments tab.
5. Copy the credentialsSave. On the General tab, under Client Credentials, check that Client authentication is Client secret. Copy the Client ID and the Client secret.
6. Note your Okta org URLIt is the address of your Okta sign-in page, for example https://acme.okta.com. Use this without -admin and without a path.

Connect Okta in Cloudraw

1. Choose OktaIn Settings→Identity & SSO→Your identity provider choose Okta.
2. Fill in the fieldsOkta URL (issuer): https://acme.okta.com. Then the client ID and client secret. Optionally set a button label and Only allow sign-in through the provider.
3. Save and testSign in from Cloudraw Connect on a test computer. You should land on your Okta sign-in page.

Step 2b. JumpCloud

1. Create the applicationIn the JumpCloud Admin Portal go to SSO Applications→Add New Application→Custom Application and choose OIDC.
2. Configure itRedirect URI: the Cloudraw redirect URI. Client authentication type: Client Secret Basic. Login URL: your Cloudraw sign-in, or any URL your portal should open. Include the Email and Profile standard scopes.
3. Copy the credentialsActivate the app and copy the Client ID and Client Secret. JumpCloud shows the secret once. Bind the user groups that should use Cloudraw.
4. Connect in CloudrawChoose JumpCloud and paste the client ID and secret. The issuer https://oauth.id.jumpcloud.com is set for you.

Step 2c. Any other OpenID Connect provider

1. Create a client at your providerA confidential web client with the authorization code flow, a client secret, the Cloudraw redirect URI as the allowed redirect URI, and the scopes openid profile email.
2. Find the issuer URLOpen <your provider>/.well-known/openid-configuration in a browser and copy the "issuer" value exactly.
3. Connect in CloudrawChoose OpenID Connect, enter the issuer, client ID and client secret, and optionally a button label (default "Company sign-in").

If saving fails with "The provider could not be configured. Check the client id, secret and issuer", check that the issuer opens the discovery document in a browser and that the ID and secret have no extra spaces.

People and groups

A person who signs in through your provider for the first time is added to People automatically and uses a seat. To have groups from your provider in Cloudraw, and to suspend people automatically when you deactivate them, set up SCIM below. Otherwise create Cloudraw groups.

Step 3 (optional). SCIM provisioning

In Cloudraw

1. Turn on SCIMOpen Settings→Identity & SSO→SCIM provisioning and click Turn on SCIM.
2. Copy the base URL and tokenThe token starts with crwscim_ and is shown once. The base URL looks like https://orchestrator-stg.cloudraw.com/v0/tenants/<workspace id>/scim/v2.

In Okta

1. Enable SCIM on an app integrationOpen the Cloudraw app, then General→App Settings→Edit, and under Provisioning select SCIM. If your Okta org does not offer SCIM on an OIDC app, create a separate SWA app integration called Cloudraw provisioning and enable SCIM there.
2. Connection settingsOn the new Provisioning→Integration tab click Edit:
   • SCIM connector base URL: the Cloudraw base URL
   • Unique identifier field for users: userName
   • Supported provisioning actions: Push New Users, Push Profile Updates, Push Groups
   • Authentication Mode: HTTP Header. Paste the crwscim_… token as the Bearer token.
   Click Test Connector Configuration, then Save.
3. Turn on actionsUnder Provisioning→To App enable Create Users, Update User Attributes and Deactivate Users.
4. Push groupsOn the Push Groups tab, push the groups you want to use in Cloudraw access rules.

Okta's userName must be the person's e-mail address. That is Okta's default when usernames are e-mail addresses. Deactivating a user in Okta suspends them in Cloudraw, and their devices lose access.

Other providers

Any provider that supports SCIM 2.0 with a bearer token works. Cloudraw supports Users and Groups, filtering by userName eq "…", externalId and displayName, and PATCH. It does not support bulk operations, sorting or password changes.

MFA: Okta Verify and others

For people who sign in through Okta, JumpCloud or another provider, MFA happens at your provider. Cloudraw does not add its own e-mail code, unless the workspace sent Cloudraw invitations before you connected the provider. See Two-factor authentication.

To require Okta Verify for Cloudraw:

1. Enroll the authenticatorUnder Security→Authenticators, make sure Okta Verify is set up and an enrollment policy asks users to enroll it.
2. Create an app sign-in policyUnder Security→Authentication Policies, add a policy, for example Cloudraw, with a rule where User must authenticate with is Password + Another factor or Any 2 factor types. Optionally require a phishing-resistant authenticator.
3. Assign the policyOn the policy's Applications tab, add the Cloudraw app.

JumpCloud: turn on MFA for users under User Management, or with Conditional Access policies on the Cloudraw application. Keycloak: add OTP or WebAuthn to the realm's browser flow.

Troubleshooting