SSO with External Identity Providers

Integrating an External Identity Provider (IdP) is Layer 2 of the authentication model. It delegates authentication to a third-party provider (Azure AD, Google, Okta, etc.) while Thinfinity Workspace retains authorization through its Directory Service (DS) accounts. The result is Single Sign-On: users log in with their corporate identity, the platform maps that identity to a DS account, and access is granted according to DS-based permissions.

Setting up SSO requires two components: an Authentication Method (the IdP integration) and an Identity Mapping (the rule that links external identities to DS accounts).

Configuring SSO on Thinfinity Workspace

SSO is configured in two steps from the Web Manager > Settings > Authentication section:

Add an Authentication Method

Go to Authentication Methods and select +Add. Select the IdP type (OAuth, SAML, or RADIUS) and complete the required fields — including Client ID, Secret Key, Authorization URL, Token Validation URL, and the field that identifies the user (e.g., email from the IdP token).

Each Authentication Method also includes a 2FA field where a second factor (TOTP, RADIUS) can be associated, connecting Layer 2 directly with Layer 3 (MFA). Optionally, configure the Sign-Out URL so that logging out of Workspace also terminates the IdP session.

Create an Identity Mapping

A mapping rule defines how an external identity is resolved to a DS account. Go to Identity Mappings and select +Add:

• Method: Which authentication method this rule applies to (e.g., Google, Azure, Okta). Use * to match any method.
• ID Mask: A regex pattern that matches the external user’s identity (typically their email from the IdP token).
• Association: How the external identity links to a DS account:
  • Inherit permissions from users/groups — the external identity acts as an existing DS account picked below; the broker uses the first entry in the list at logon.
  • Ask for credentials to associate — the user is prompted for DS credentials on first login and the mapping is persisted.
  • Associate existing username — binds the external identity to a specific DS user (with optional regex substitution against the IdP login).
  • Create username if it doesn’t exist and associate — resolves the same as Associate existing username, then creates the DS user if it does not exist.

What Comes Next

With SSO configured, you can strengthen the security model further:

• Multi-Factor Authentication: Add a second verification step — either through Thinfinity’s native TOTP, via the IdP’s own MFA, or through a RADIUS server.
• Passkeys (WebAuthn): Offer passwordless login as an alternative or complement to IdP-based authentication.

See the Authentication Schemes overview for guidance on combining layers.