How do SSO and single logout work for Workplace and Studio on CP4BA with Azure AD / Okta?

Question

We want users to log in to Workplace with our corporate identity provider (Azure AD) instead of LDAP passwords. On WebSphere we used a SAML TAI. How is this configured on the Cloud Pak and what about API clients?

Answer 1

Identity federation is done once at the platform level in IAM (foundational services), not per workflow server. Workplace, Studio, Navigator and the REST front door then all accept the IdP session:

1. Register the IdP in IAM: Cloud Pak dashboard > Access control > Identity providers > add OIDC (Azure AD app registration: client id / secret, discovery URL) or SAML (metadata XML). LDAP can stay as a second provider for technical users and group resolution.
2. Onboard users: assign Zen roles to groups from the IdP (OIDC group claims / SAML attributes) so that new users get the Workflow permission at first login.
3. Map to BAW: teams and tw_admins still resolve through the user's groups - make sure the group names the IdP sends match what the process apps expect (or keep LDAP for groups with the same user ids).
4. Logout: IAM implements front-channel logout to the IdP for OIDC providers that support it; Workplace's logout ends the Zen session and redirects to the IdP's end-session endpoint when configured.

# IAM IdP registration can also be scripted (foundational services API)
curl -sk -X POST "https://cpd.../idprovider/v3/auth/idsource" -H "Authorization: Bearer $ADMIN_TOKEN" -H "Content-Type: application/json" -d '{
  "name": "azuread", "type": "OIDC", "description": "Corporate Azure AD",
  "idp_config": { "discovery_url": "https://login.microsoftonline.com/<tenant>/v2.0/.well-known/openid-configuration",
                  "client_id": "...", "client_secret": "...", "token_attribute_mappings": { "sub": "oid", "groups": "groups", "given_name": "given_name", "family_name": "family_name", "email": "email" } }
}'

API clients are unaffected by the browser SSO: they keep using Zen API keys or bearer tokens (question on REST authentication). Differences from the WebSphere TAI era: no per-cell keystore of IdP certificates (IAM handles metadata), no ltpa cookie sharing with other WebSphere applications (use OIDC on both sides), and the user id BAW sees is the IdP subject mapping - check task history and audit before switching an existing user base (ids must stay identical or tasks assigned by user id are orphaned).

References

• CP4BA documentation - configuring identity providers (IAM, OIDC, SAML)