Add SSO Provider Panel

Overview

The Add SSO Provider panel is a configuration workflow wizard designed to register external identity providers into the platform. It maps secure client applications, configures endpoint discovery protocols, and aligns external identity claims to local platform profiles.

The platform currently supports the following SSO providers:

• Google
• Okta
• Microsoft Azure / Microsoft Entra ID
• Keycloak

Panel Configuration Sections

Access Requirements

This page is available only to users with Administrator privileges.

Only administrators can view and manage SSO Provider configurations. Non-administrator users cannot access this page.

Users without administrator privileges will receive the following authorization error:

Access Denied

You don't have access to this resource.

User Attributes

The entry interface is logically partitioned into connection mechanics, attribute maps, and validation configurations.

1. Connection Parameters

Core configuration strings required to execute proper authentication flows with the identity provider:

• Provider: A dropdown menu used to designate the target identity provider.
• Base URL: The primary domain or server host address of the provider.
• Well-Known Endpoint: The configuration discovery URL used to automatically retrieve the provider's OpenID Connect / OAuth2 metadata.
• Client Id: The unique application identifier assigned to DataFloem by the external identity provider.
• Client Secret: The protected client credential token used during authentication exchanges. Visibility can be toggled via the eye icon.
• Is Active: A master toggle defining whether the SSO pipeline is operational after creation.

2. User Attributes

Delineates how identity assertions and user claims returned by the external IdP are translated into local user accounts:

• Username: Maps the remote identifier claim destined to represent the platform login identity.
• First Name / Last Name: Claims designated to populate the user's profile name components.
• Email: The target token field containing the user's enterprise email address.

3. Validation Parameters

A dynamic Key / Value matrix allowing administrators to inject custom claim validations, audience restrictions, or optional request arguments.

Additional validation parameters can be added using the add (+) button or removed using the trash (🗑️) option.

Identity Provider Configuration

Before saving an SSO Provider in DataFloem, the corresponding application/client must be created and configured in the selected identity provider.

The following callback URL must be used:

<base_url>/api/v1/public/authentication/external-token-exchange

For example:

http://10.34.41.235:30242/api/v1/public/authentication/external-token-exchange

Important: Replace <base_url> with the actual DataFloem base URL of the target environment. In production environments, use the appropriate HTTPS URL.

Google

For Google, create an OAuth 2.0 client and configure the callback URL under Authorized redirect URIs.

Add the following URI:

<base_url>/api/v1/public/authentication/external-token-exchange

Example:

https://datafloem.example.com/api/v1/public/authentication/external-token-exchange

The callback URL must exactly match the redirect URI used by the application. Differences in scheme (http/https), hostname, path, or trailing slash can result in a redirect_uri_mismatch error.

Okta

For Okta, create an OIDC - OpenID Connect application integration and configure the callback URL under Sign-in redirect URIs.

Add the following URI:

<base_url>/api/v1/public/authentication/external-token-exchange

Example:

https://datafloem.example.com/api/v1/public/authentication/external-token-exchange

The configured URI must match the redirect URI sent by DataFloem during the authentication flow.

Microsoft Azure / Microsoft Entra ID

For Azure, register an application in Microsoft Entra ID and configure the redirect URI under:

Authentication → Platform configurations → Web → Redirect URI

Add the following URI:

<base_url>/api/v1/public/authentication/external-token-exchange

Example:

https://datafloem.example.com/api/v1/public/authentication/external-token-exchange

The application must be configured as a Web application when using the server-side authentication flow.

Keycloak

For Keycloak, create/configure the client and add the callback URL under Valid Redirect URIs.

Add the following URI:

<base_url>/api/v1/public/authentication/external-token-exchange

Example:

https://datafloem.example.com/api/v1/public/authentication/external-token-exchange

Keycloak performs exact, case-sensitive matching for configured redirect URIs. Redirect URIs should be as specific as possible. Avoid using broad wildcard patterns such as * in production environments.

Callback URL Summary

The same DataFloem callback endpoint is used for all supported providers:

Deployment Process

1. Create an application/client in the selected identity provider:

   • Google
   • Okta
   • Microsoft Azure / Microsoft Entra ID
   • Keycloak

2. Configure the provider's redirect/callback URI using:

   <base_url>/api/v1/public/authentication/external-token-exchange

3. Obtain the required client credentials from the identity provider:

   • Client ID
   • Client Secret

4. Obtain the provider's OpenID Connect discovery endpoint (Well-Known Endpoint) where applicable.

5. Open the Add SSO Provider panel in DataFloem.

6. Select the appropriate Provider.

7. Populate the Connection Parameters:

   • Base URL
   • Well-Known Endpoint
   • Client Id
   • Client Secret
   • Is Active

8. Configure the User Attributes mapping:

   • Username
   • First Name
   • Last Name
   • Email

9. Configure any required Validation Parameters.

10. Click Save to deploy the SSO integration.

11. Click Cancel to abort the configuration without saving.