|Manuals

Verge.IO

Thinfinity® Cloud Manager connects to Verge.IO using either username/password credentials or OIDC (OpenID Connect) authentication. This article documents the Cloud Manager credential form for Verge.IO, the prerequisites, and common configuration errors.

Prerequisites

Cloud Manager calls the Verge.IO management interface from the Thinfinity® Workspace server: the Workspace server is the client, and the Verge.IO management interface is the destination. Two conditions follow:

  • On the Verge.IO side, the management interface must accept HTTPS connections from the Workspace server on the port it is published on — 443 by default, or the custom port set in your Verge.IO deployment.
  • On the Workspace server side, this traffic is outbound and needs no inbound port; outbound HTTPS is typically already permitted. If an egress firewall or proxy restricts outbound traffic from the Workspace server, allow outbound HTTPS to the Verge.IO management interface on that port.

For the complete network and firewall matrix, see Prerequisites.

The following must also be in place on the Verge.IO side:

  • For Username/Password authentication: a Verge.IO local user account with sufficient permissions to list and manage virtual machines. Cybele Software recommends a dedicated service account rather than an administrative account.
  • For OIDC authentication: an OIDC identity provider (e.g., Microsoft Entra ID, Okta, Keycloak) is configured in your Verge.IO environment, and an application is registered for Verge.IO with a Client ID and Client Secret.

Cloud Manager does not enforce a specific Verge.IO role server-side — the per-operation success or failure is determined by what Verge.IO allows for the configured user.

For how to manage Verge.IO users, permissions, and OIDC integration, refer to the Verge.IO documentation.

Authentication Methods

Cloud Manager authenticates to Verge.IO in one of two ways. Use username/password (Option A) for a direct Verge.IO local user account. Use OIDC (Option B) when Verge.IO is integrated with an external identity provider such as Microsoft Entra ID, Okta, or Keycloak.

Option A — Username / Password Authentication

Add the Credentials in Cloud Manager

  1. In Cloud Manager, go to Credentials and click + New.
  2. Select Verge.IO as the provider.
  3. Ensure Use OIDC Authentication is disabled.
  4. Fill in the fields below and click Save.

For the full Add / Edit / Delete procedure, see Managing Credentials.

Credential Fields

Field Description
Server The FQDN or IP address of the Verge.IO server or cluster (e.g., vergeio.corp.local or 192.168.1.30). Do not include a protocol prefix or trailing slash.
Allow Insecure SSL If enabled, Cloud Manager skips SSL certificate validation for the Verge.IO connection. Only use this in isolated, fully trusted networks.
Use OIDC Authentication Leave disabled for username/password authentication.
Username The Verge.IO local user account username.
Password The password for the Verge.IO user account.

Option B — OIDC Authentication

Use this method when Verge.IO is configured to authenticate users through an external OIDC identity provider.

Cloud Manager does not run the OIDC authorization-code flow itself — there is no in-product browser prompt for logging in to the identity provider. It supports two paths:

  • Client Credentials flow (recommended for service accounts). Provide OIDC Issuer URL, OIDC Client ID, and OIDC Client Secret. Cloud Manager discovers the token endpoint from the issuer’s .well-known configuration and exchanges the client credentials for an access token automatically. Leave OIDC Access Token and OIDC Refresh Token empty.
  • Pre-obtained tokens. If your identity provider requires an interactive flow that Cloud Manager cannot perform, obtain the access token and refresh token out-of-band — through the IdP portal, a CLI, or a separate OIDC client — and paste them into the credential form. Cloud Manager then uses the refresh token to renew the access token as needed.

Add the Credentials in Cloud Manager

  1. In Cloud Manager, go to Credentials and click + New.
  2. Select Verge.IO as the provider.
  3. Enable Use OIDC Authentication. The OIDC fields become visible.
  4. Fill in the fields below and click Save.

For the full Add / Edit / Delete procedure, see Managing Credentials.

Credential Fields

Field Description
Server The FQDN or IP address of the Verge.IO server.
Allow Insecure SSL Enable when the Verge.IO server presents a self-signed certificate or a certificate signed by an internal CA that the Thinfinity Workspace host does not trust. Leave disabled in production deployments backed by a public CA.
Use OIDC Authentication Enable to use OIDC authentication.
OIDC Issuer URL The base URL of your OIDC identity provider (e.g., https://login.microsoftonline.com/<tenant-id>/v2.0).
OIDC Client ID The client ID of the application registered for Verge.IO in the identity provider.
OIDC Client Secret The client secret for the registered application.
OIDC Scope The scopes to request from the OIDC provider, space-separated (e.g., openid profile email). The field is optional — when left empty, Cloud Manager applies the default openid profile email automatically.
OIDC Access Token A current access token, obtained out-of-band from the identity provider’s token endpoint. Required only for the pre-obtained tokens path; leave empty when using the Client Credentials flow.
OIDC Refresh Token The refresh token used to obtain new access tokens when the current one expires. Required only for the pre-obtained tokens path; leave empty when using the Client Credentials flow.

Verification

After saving, Cloud Manager validates the credentials by connecting to the Verge.IO API and querying the VM inventory. If validation succeeds, the credential status shows as Ok.

Common Errors

Error Likely Cause Resolution
401 Unauthorized Incorrect username or password, or the OIDC access token has expired or been revoked. Verify the account credentials in the Verge.IO management interface. For OIDC, refresh the access token.
SSL certificate error The Verge.IO server uses a self-signed or untrusted certificate. Enable Allow Insecure SSL for lab environments, or import the Verge.IO CA certificate into the Workspace server trust store.
OIDC: invalid_client The OIDC Client ID or Client Secret is incorrect. Verify the application registration in your identity provider.
OIDC: token_expired The OIDC access or refresh token has expired. Re-authenticate to obtain new tokens and update the credential in Cloud Manager.
Connection timeout The Workspace server cannot reach the Verge.IO management interface. Verify network connectivity and firewall rules. See Prerequisites.

Security Recommendations

  • Create a dedicated Verge.IO service account with the minimum permissions required for Cloud Manager, rather than using an administrative account.
  • Use OIDC authentication when possible — it centralizes identity management and enables token revocation without modifying Verge.IO local accounts.
  • Avoid Allow Insecure SSL in production environments. Configure Verge.IO with a certificate signed by a trusted CA.

See Also