CyberSiftCertificate Manager
Free trial

Docs · 5 of 7

Sign-in: Entra ID, OIDC and LDAP

The built-in administrator always signs in with its password. Everyone else signs in with your existing directory. Both options live in Config → Sign-in, and both are tested before they are saved.

Tip: the Sign-in page can produce a ready-made request to send to your Entra administrator, with every value they need filled in.

Microsoft Entra ID

  1. Register the app. In Entra: App registrations → New registration. Supported accounts: this organisational directory only.
  2. Add the redirect address. Authentication → Add a platform → Web, with redirect URI https://<portal>/auth/oidc/callback. (Set the portal's public address in Settings first.)
  3. Create a secret. Certificates & secrets → New client secret, and paste its value into the portal.
  4. Send group names. Token configuration → Add groups claim, with these settings:
    • group types: Security groups;
    • for ID, Access and SAML, choose sAMAccountName;
    • leave Emit groups as role claims unticked.
  5. Optional: allow group search. API permissions → Microsoft Graph → Application: User.Read.All and GroupMember.Read.All, then Grant admin consent. This lets you search for groups when setting up access and departments.
  6. Save & test in the portal, then add groups or people in Config → Access with their role.

Groups arrive by name, for example SG-Cert-Admins: use the same names in Config → Access. For cloud-only groups, choose Group ID in step 4 and use the group object IDs instead.

Other OIDC providers

Any standard OpenID Connect provider works the same way: enter its issuer address, client ID and secret, and the claim that carries group membership.

LDAP / Active Directory

In Config → Sign-in → LDAP, enter:

Setting Example
Server ldaps://dc.example.com
UPN domain example.com
User search base DC=example,DC=com
Group attribute memberOf

People sign in with their usual directory password, and their groups decide their role. An optional read-only search account lets you search groups when setting up access.

When a sign-in fails

Config → Sign-in → Sign-in diagnostics keeps the last 50 attempts and shows every step: the redirect, the provider's answer, the token check, the directory lookup and the access decision. A failed sign-in shows the person a reference number you can look up there. No passwords or secrets are stored.