Sheet POR-02 · Identity Manual
Federation & Access Delivery
Sign-in through your existing identity provider, application access, provisioning, guests and migration.
Two directions of trust
Portal configures trust in two places:
- SSO & Federation: Portal trusts your company’s identity provider, such as Entra ID, Okta, or any OIDC or SAML provider. People sign in to Portal with the account they already have.
- Applications: your applications trust Portal. Portal is the identity provider that signs people in to them.
Connecting your identity provider
A connection routes users only after you test it, add a routing rule, and enable both. The steps are in Federation Operations.
To turn upstream group claims into Portal group membership, create the Portal group first and map each upstream group value to it. Portal ignores unmapped values. Federation sync removes only the memberships it created, so manual and SCIM memberships stay in place.
Applications and provisioning
The Applications list holds the Cadres products, Marketplace installs, and your own bookmark, OIDC and SAML applications. Give access through groups and roles so it follows directory changes.
Upstream identity providers such as Entra ID, Okta and OneLogin can provision users and groups into Portal over SCIM 2.0.
Guests
A partner or contractor from another tenant joins yours through a guest invitation. Accepting it creates an access grant in your tenant, not a membership. You can suspend, reissue or revoke the grant from Guest Access.
Moving from another identity provider
Identity migration collects an inventory from Okta, Entra ID, a SCIM 2.0 source or a CSV file, assesses what will carry over, and builds a cutover plan you can preview, apply and roll back. See Identity Migration.