
The **Authorization Code Flow + PKCE** is an OpenId Connect flow specifically designed to authenticate native or mobile application users.

Applications without the ability to store a client secret, such as native or single-page apps, employ this grant type  (SPA).

**Proof Key for Code Exchange, or PKCE** for short, is an abbreviation. Users are not required to submit a client secret in the PKCE route, which differs significantly from the conventional Authorization Code flow in this regard. Because embedded secrets are not required in source code, PKCE lowers security risks for native apps by limiting the potential for reverse engineering.  

### Why PKCE Authentication is Required? {#Why PKCE Authentication is Required?}   

Some additional security risks are raised when public clients (such as native and single-page programs) ask for access tokens that are not addressed by the Authorization Code Flow alone.  
This is because

#### **Native apps:**  
Cannot securely store a Client’s Secret. Decompiling the app will reveal the Client Secret, which is bound to the app and is the same for all users and devices.
May make use of a custom URL scheme to capture redirects (e.g., MyApp://) potentially allowing malicious applications to receive an Authorization Code from your Authorization Server.  

#### **Single-page apps:**  
Cannot securely store a Client Secret because their entire source is available to the browser.
OAuth 2.0 offers a variant of the Authorization Code Flow that uses a Proof Key for Code Exchange (PKCE) in light of these circumstances (defined in OAuth 2.0 RFC 7636).

The calling application creates a secret known as the Code Verifier that may be confirmed by the authorization server in the PKCE-enhanced Authorization Code Flow. In order to obtain an Authorization Code, the calling app also produces a transform value of the Code Verifier called the Code Challenge and delivers it over HTTPS. In this manner, a hostile attacker can only intercept the Authorization Code and cannot use the Code Verifier to swap it for a token.

### How does it work? {#How does it work?}
In place of the **client_secret**, the client app creates a unique string value, **code_verifier**, which it hashes and encodes as a **code_challenge**. When the client app initiates the first part of the Authorization Code flow, it sends a hashed **code_challenge**.  

Once the user authenticates and the authorization code is returned to the client app, it requests an **access_token** in exchange for the authorization code.  

In this step, the client app must include the original unique string value in the **code_verifier** parameter. If the codes match, the authentication is complete and an **access_token** is returned.


### PKCE Authentication Flow {#PKCE Authentication Flow}
The processes are quite similar to those of **Oauth** because the **PKCE-enhanced Authorization Code Flow** builds upon the conventional Authorization Code Flow.

![PKCE Authentication Flow](/blog/assets/2023/pkce-authentication-flow.webp)  

1. Within the application, the user selects **Login**.
2. The SDK for miniOrange constructs a cryptographically random code verifier and a code challenge from it.
3. The user is forwarded to the miniOrange Authorization Server (**/authorize endpoint**) via the miniOrange SDK along with the code challenge.
4. The user is forwarded to the login and authorization prompt by your **miniOrange Authorization Server**.
5. A consent page outlining the permissions miniOrange will provide to the application may be displayed after the user authenticates using one of the predefined login options.
6. As the user is redirected back to the application with an authorization code that is valid for one usage, your miniOrange Authorization Server records the code challenge.
7. This code is sent to the miniOrange Authorization Server (/oauth/token endpoint) via the miniOrange SDK together with the code verifier established in step 2.
8. The code challenge and code verifier are verified by your miniOrange Authorization Server.
9. A response from your miniOrange Authorization Server contains an access token and an ID token (and optionally, a refresh token).
10. The access token can be used by your application to contact an API and access user data.
11. The requested data is returned by the API.
 

### How to implement PKCE with miniOrange? {#How to implement PKCE with miniOrange?}
The easiest way to implement the Authorization Code Flow with PKCE is to follow our [Native Quickstarts](https://www.miniorange.com/integrations/). (These setup guides will help you with setup).  

&nbsp;  

Depending on your application type, you can also use our mobile or single-page app SDKs:  
[Download](https://miniorange.s3.amazonaws.com/public/plugins/idp/jwt-connector.zip%22) Mobile SDK’s.

&nbsp;  

&nbsp;  

#### **More Resources:**
- [What is OAuth? How does it work?](https://blog.miniorange.com/what-is-oauth-2/)
- [OAuth Server Service by miniOrange](https://www.miniorange.com/products/oauth2-server)
- [OAuth API Docs](https://developers.miniorange.com/docs/idp/api/oauth-api) 


 Learn how the Authorization Code flow with Proof Key for Code Exchange (PKCE) works and why you should use it for native and mobile apps.

Authorization Code Flow with Proof Key for Code Exchange (PKCE)


## Automated Provisioning

Imagine manually onboarding hundreds of new employees at once. If you’re a corporate organization that doesn’t have an IAM, that’s often the case. How do you provision hundreds of new users to their respected systems & applications efficiently? **Read through the blog & find the solution yourself**.

### What is Automated Provisioning? {#what-is-automated-provisioning}

**Automated provisioning** or **Automated User Provisioning** is the method of granting & managing access to apps, websites, data & systems within your organization, through an automated process.

But just as automated provisioning can deploy & activate services for users, it can also remove user access from systems, applications & data. This is called automated de-provisioning. It’s much more efficient than traditional processes of employees’ onboarding & offboarding as changes occur across an organization.

### How does automated provisioning work? {#how-does-automated-provisioning-work}

In the IAM context, [auto-provisioning](https://bit.ly/3HrIka1) automates the [provisioning](https://blog.miniorange.com/what-is-provisioning/) of apps/websites or other resources to users across the organization. But how does it work? Automated provisioning grants employees access to applications & resources based on their role & permission levels without the involvement of manually working on user access requests until approved, processed, & activated.

![Automated Provisioning Flow](/blog/assets/2023/automated-provisioning-flow.webp)

For eg:

1. A new employee joins your company, your company’s [identity management platform](https://bit.ly/3uqEDxE) say miniOrange will assign that worker a role through their system.
2. The employee is granted access to apps/websites based on their role.
3. Their access will be automatically adjusted or revoked if in case they change roles or leave the organization.

### Benefits of automated provisioning {#benefits-of-automated-provisioning}

**Security -**

It guarantees that you provide the right permissions for the right people.

**Streamlined onboarding -**

Automated provisioning allows you to take the onboarding burden off of your Human Resources or IT department through automated provisioning.

**Cost Efficient -**

With automated provisioning, you can free up time & resources for other tasks.

**Error reduction -**

Because automated provisioning eliminates manual processes, it also greatly reduces the margin of error.

### Why does your company need Automated provisioning? {#why-you-need-automated-provisioning}

**Problem :** In many organizations, HR departments use Microsoft Active Directory (AD) to manage access permissions of employees & devices. AD provides appropriate access privileges to company resources, but it comes with some drawbacks. With AD, IT departments need to spend time managing, configuring & installing each individual cloud app, and provision users manually when they join the organization or change roles. These tedious tasks divert teams’ time & focus from more impactful projects and are prone to human errors that ultimately limit the efficiency of any business.

![User and Group Provisioning](/blog/assets/2023/automated-provisioning-setup.webp)

**Solution :** [miniOrange](https://bit.ly/3uqEDxE) has the ability to synchronize users with HR applications such as [Workday](https://bit.ly/3uiE5df), Microsoft, [BambooHR](https://bit.ly/3s9iJMN) & many more. Now, when an employee is created, updated, or removed in the HR app, miniOrange detects the change and propagates it through all integrated apps & systems – including Active Directory, cloud apps, or on-premise. Because the employee is automatically removed from apps, the seat is freed up, [saving money](https://bit.ly/3GnT6g4) on apps that charge based on active users. This method has the added benefit that on-prem applications which may be integrated with AD are immediately updated as well when users are terminated in the HR system.

### miniOrange has pre-integrated apps for Auto Provisioning and Deprovisioning {#miniorange-pre-integrated-apps}

1. [Azure/Active Directory](https://bit.ly/3rkRFLh)
2. [G-Suite App](https://bit.ly/3GrHubY)
3. [Microsoft 365](https://bit.ly/32SBdID)
4. [Salesforce](https://bit.ly/3gpdNO4)

Find your required Application for Auto-Provisioning [here](https://idp.miniorange.com/apps-integration/?id=provisioning).

![miniOrange Identity Providers Integration](/blog/assets/2023/automated-provisioning-apps.webp)

### Provisioning with SCIM & Understanding its Importance {#provisioning-with-scim}

SCIM, or the System for Cross-domain Identity Management (opens new window)specification, is an open standard designed to manage user identity information. SCIM provides a defined schema for representing users and groups, and a RESTful API to run CRUD operations on those user and group resources. The goal of SCIM is to securely automate the exchange of user identity data between your company’s cloud applications and any service providers, such as enterprise SaaS applications. You can simplify permissions for:

1. User Account Provisioning
2. Group Provisioning
3. User-Group Assignment

For more details refer : [SCIM Provisioning Gateway](https://bit.ly/3JULXWk)

### Additional Resources {#additional-resources}

-   Salesforce Provisioning
-   Azure AD Provisioning
-   JIT Provisioning


Automated Provisioning streamlines user management across apps/websites, increases security, reduces risk, saves time and money.

Automated Provisioning | 4 main benefits of Automated User Provisioning


## Crowd User Management at your fingertips 🙌

Hello Crowd Admins!

An acronym for System for Cross-domain Identity Management, SCIM is an open standard that helps in automating the user identity lifecycle management process.

That’s the industry definition, sounds complicated! Let’s see if we can simplify it a bit with the help of this article. It’s all about ‘identity and access management (IAM),’ the concept has been around for quite some time. Think about if you are able to create a user account in one system and matching accounts automatically get created in other systems the user needs access to.

Sounds amazing but it’s not so simple as each system may have its own unique connection methods such as LDAP, SQL, ADSI, custom APIs, etc. That’s where SCIM comes into the picture, it is designed to make managing user identities in cloud-based services and applications easier, but before we go further let’s dive into…

### Why SCIM? {#why-scim}

Instead of the ‘what’ let’s begin with the ‘why.’ We use different cloud-based SaaS applications such as Salesforce, Zendesk, GitHub, Trello, etc. in our daily work routine depending on our role. These applications were assigned to us when we initially joined. This is done by the IT Admin of the company, now think for a minute if a company has less than 10 employees, manually adding them to the application might work but what if the size of the company runs into hundreds or thousands, the task becomes challenging. And, what about when an employee leaves or is terminated from the company they are removed from the company’s employee directory and all access revoked?

The crowd is the tool given by Atlassian which manages users and groups for all Atlassian apps. Crowd is a centralized directory and the access and authorization to Jira, confluence applications are very much dependent on Crowd.

We are pleased to present to you the app that aims to solve your most complex problem. Syncing & Managing users in a crowd is now a problem of the past! Introducing the miniOrange [Crowd SCIM Plugin](https://marketplace.atlassian.com/apps/1229918/mo-scim-provisioning-user-group-sync-for-crowd?hosting=datacenter&tab=overview) 🎉

The Crowd SCIM plugin connects Crowd with your Identity Provider. You can connect different Identity Providers such as Okta, Azure AD, Onelogin, Keycloak, G Suite and any SCIM Supported IDPs for provisioning. Unleash the true potential of Crowd giving you access to features like:-

**Provision & De-Provision users 🔁**

Easily provision and de-provision users in Crowd in sync with your Identity Provider.

**Update/Activate/Deactivate users ✅**

Automatically update the details of users, and activate and deactivate user accounts (If deleted or deactivated in IDP) to save extra license costs and improve the security of your organization.

**Real-Time Provision Users 🚀**

As soon as a user is created on your Identity Provider, it will automatically be created in Crowd, in REAL TIME!!!!

**IDP App-specific provisioning 🖥️**

You can choose provisioning features based on your configured IDPs. Isn’t that great?

**Transform username based on regex for matching user 🧑‍**

Do your users have different usernames in your IDP and different usernames in Crowd? We’ve got you covered. This feature will allow you to transform the username received from the IDP and create or update the desired username in Crowd.

![Crowd User Management Sync](https://miniorange.com/atlassian/wp-content/uploads/sites/14/2023/01/Crowd-SCIM.webp)

I hope you enjoy this plugin as much as we did while creating it. While this is what we’re offering now, here’s our roadmap for the next release:

-   Upcoming Features 🛣️

-   Scheduled Provisioning

-   Filter users by groups for assigning

-   Manual user sync button

-   Sync/update users upon successful authentication

Feel free to reach out to us at [atlassiansupport@xecurify.com](mailto:atlassiansupport@xecurify.com) for a free demo, setup, or any custom use case. We’re happy to help 😄

Try the miniOrange Crowd SCIM plugin today!


Use Crowd SCIM to sync your users, groups and directories with SCIM for Server/DC. Support for Azure AD, Okta, Onelogin, Oracle IDCS, ... IDPs

Crowd User Management at your fingertips


This month, we’re focusing on how Identity and Access Management (IAM) works and where it’s used. IAM is a critical part of cybersecurity, and it’s important to understand how it works and where it’s used in order to keep your online identity safe.

Identity and access management (IAM) is an emerging field that includes not only traditional role-based access models but also cloud-based, federated identity management. IAM also provides organizations with a secure and scalable foundation for managing their enterprise, on-premise, and/or cloud-based resources.

The idea behind IAM is that if you have multiple employees working on different projects at the same time, you don’t want them all having access to each other’s accounts. Instead, they should be assigned different accounts so they can’t accidentally share passwords or cause any damage by downloading files from each other’s computers. 

### How Identity and Access Management Works? {#How Identity and Access Management Works?}   

IAM is all about managing access to online resources. It’s used to authenticate and authorize users to access specific resources. IAM systems manage access to websites, applications, and data.  
There are many different types of IAM systems, but they all have one common goal: to protect your online identity by verifying it and making sure that you have the appropriate permissions to access the resources you’re trying to access.  

Some common features of IAM systems include:

- User account management: creating and managing user accounts, setting passwords, and managing user permissions
- Authentication: verifying the identity of users who are trying to access systems and data
- Authorization: granting or denying access to systems and data based on user permissions

### Where Identity and Access Management is Used? {#Where Identity and Access Management is Used?}

IAM systems are used in various industries, including healthcare, finance, government, and education. Each industry has its own unique requirements for IAM, but the overall goal is always the same to keep your online identity safe.  

The best way to protect your online identity is to use a strong IAM system. IAM systems are designed to keep your information safe and ensure that only the people with the appropriate permissions can access it.


### How can Single sign on and multi-factor authentication help you protect your online identity? {#How can Single sign on and multi-factor authentication help you protect your online identity?}

IAM systems can also help to improve the efficiency of an organization by reducing the need for multiple passwords and by providing a single sign-on solution for accessing multiple systems.  

IAM systems are an essential part of any organization’s security strategy, and they are critical for protecting data and ensuring that only authorized users have access to the resources they need.  

Multi-factor authentication adds an extra layer of safety to your accounts. With multi-factor authentication, you’re typically asked to provide a code that’s sent to your phone or email.
 

### Consider these few things if you're looking for an IAM system for your business {#Consider these few things if you're looking for an IAM system for your business}

- **You need to find an IAM system that meets your specific needs.**  
There are many different types of IAM systems, so it’s important to find one that’s right for your business.  

The most common types of IAM systems include Active Directory, IDP, Single sign-on, Multi-factor authentication, LDAP, and Kerberos. Each of these systems has its own strengths and weaknesses, so it’s important to understand what each one is good for before you choose which one to use.  

&nbsp;  

- **You need to make sure that your IAM system is properly implemented.**  
IAM systems are complex, and they need to be properly implemented in order to work properly.  

The key here is to make sure that all the users have access to the resources they need. A good practice is to create an account for each user and assign them a unique username and password. This way you can ensure that every user has their own account, which will allow them to access the data in any way they need.  

Another important thing is that all of these accounts must be protected by different passwords or keys, so no one can access another person’s data or resources without their knowledge. If you want to make it even more secure, you can use multi-factor authentication (MFA) where you will require two different passwords from each user.  

&nbsp;  

- **You need to make sure that your IAM system is always up to date.**  
IAM systems are constantly changing, and you need to make sure that your system is always up to date.  

The main disadvantage of not updating the IAM system is that it will not be able to provide the best security to your users. The reason for this is that the system is constantly changing, and if you don’t update, then your users will be at risk. Another reason why it’s important to keep your IAM system updated is that if you don’t update it, then hackers can hack into your system and gain access to all of your data. If this happens, then they will be able to steal passwords and other information from your users’ accounts.  

Another disadvantage of not updating your IAM system is that it can cause problems with user error. If a user forgets their password or doesn’t update their password when prompted by an automated email message, then this could result in someone breaking into their account and stealing their information.

&nbsp;  

miniOrange’s core identity product provides central and converts IAM solutions with bring together some of the most sorts after IAM features such as Single Sign-On (SSO), Multi-factor Authentication (MFA), Risk-Based Authentication, User Life Cycle Management which includes User Provisioning and De-Provisioning, Universal Directory and few more specific and segregated features to ensure that your entire Identity journey is a seamless handle from one central platform. We believe that security can be simple and with a high return on investment and we eliminate friction in the IAM journey of our users by complete end-to-end support for every single admin product interaction.  

IAM is a critical component of any cybersecurity program, and it’s important to understand how it works. IAM helps to prevent unauthorized access to resources, and it’s also important for compliance purposes.  

Cybersecurity Awareness Month is the perfect time to review your IAM strategy. If you’re not using SSO or MFA, now is the time to start. Contact miniOrange about how Single sign on and multi-factor authentication can help you protect your online identity.

&nbsp;  

#### **More Resources:**
- [Single Sign-On](https://www.miniorange.com/products/single-sign-on-sso)
- [Workforce Identity](https://www.miniorange.com/workforce-identity)
- [What is CIAM](https://blog.miniorange.com/what-is-ciam-customer-identity-and-access-management/) 


IAM is a critical part of cybersecurity, and Single Sign-On (SSO) & multi-factor authentication (MFA) can help you protect your online identity.

Do you have an IAM setup? Cybersecurity Awareness Month, Focuses on how and where IAM is used


## How miniOrange SCIM Simplifies Centralized IDP User Management in Atlassian Apps

If your business relies on various Atlassian applications and services to conduct your day-to-day operations, you would certainly relate that managing user accounts and their access could be challenging and often time consuming. This is where **miniOrange’s User Sync/SCIM** App comes into play.

SCIM an acronym for ‘System for Cross-domain Identity Management’ is a protocol that allows for automated provisioning and de-provisioning of user accounts between different systems. Our app allows seamless login into the **Jira, Confluence. Bitbucket, Crowd** and other Atlassian applications with Identity Provider (IdPs) like [Azure Active Directory, Keycloak, Okta, OneLogin, Oracle and more.](https://developers.miniorange.com/docs/atlassian/scim/overview)

To get a better understanding of its use cases, let’s take Okta as the identity provider and an application, say Jira:

### New Employee Onboarding (User Creation) {#user-creation}

When we talk about user creation, we refer to the process of adding a new user account to various systems that they may require. This usually happens when a new employee joins an organization and would need access to, say for instance, a team collaboration tool (Confluence) or a project management tool (Jira), if a developer then probably a tool to effectively store, manage and monitor codes (Bitbucket).

Let’s say when a new employee joins your company, the IT administrator with user information like username, email, and other relevant details would create a new user account in Okta (IDP), and then miniOrange User Sync/ SCIM ensures that accounts created in Okta is automatically replicated in Jira, profiles and attributes are in sync between both the systems.

### Change in User Information (User Updation) {#user-updation}

User information like email address, phone number, or role may change over time, and it’s essential to keep this information updated and ensure that it is consistent in all applications. Any such changes can also be automatically updated using miniOrange User Sync/ SCIM. Admins can easily update user information in Okta and those changes would reflect in Jira.

For example, if a user changes their phone number, you can update that information in Okta and the changes would be synced in Jira so that it’s consistent with both systems.

### Revoking User Access (Deactivation) {#user-deactivation}

When an employee leaves the company their access to company resources should be removed to maintain security and compliance. It also could be the case that a user’s access to certain systems needs to be revoked based on role change. This process of deactivation is automated just like the above with the app and once a user is deactivated in Okta, SCIM App will automatically deactivate the corresponding user in Jira.

For example: if an employee leaves the company, the HR department would disable their account in Okta and the miniOrange User Sync/SCIM would then automatically disable or remove the user’s account in Jira so that their access to the application is revoked.

### Assigning Groups to Users (Group Mapping) {#assigning-groups-to-users}

![SCIM flow diagram](/blog/assets/2023/miniorange-scim-for-atlassian-apps.webp)

Another essential use case is that it enables admins to manage user access to different resources and applications based on their group, in other words, it refers to the process of associating users with specific groups. With miniOrange User Sync/SCIM, you can map users to groups in Okta and Jira. This ensures that users have the necessary access to resources based on their roles and responsibilities. Group mapping can be done manually or [on the fly](https://developers.miniorange.com/docs/atlassian/scim/user-groups).

**Manual Group Mapping** involves manually assigning users to groups in Okta and Jira. It is useful when your IdP group names and local application group names are different here you would have to map each IdP group to the application group manually.

It allows you to manually map Jira groups with the groups from Okta or filter groups, and make changes to existing users. Manual Group Mapping is useful when you want to manage groups from Okta but the group name differs in Okta and Jira.

For example, if the name of the group in Okta is Dev users but the name of a similar group in Jira is Software_dev. In such scenarios, you would have to manually map each Okta group to the Jira group.

**On-the-fly** group mapping refers to the process of dynamically mapping users to groups. For instance, when group names in Okta and Jira are an exact match, the app would detect the groups and add users to those groups automatically and if a group doesn’t exist in Jira then it would be created.

Let’s say for better clarity, you use Okta for identity and access management and Jira for project management. There are several teams working on different projects, each team has its own group with a unique name, here let us consider “Marketing” group in Okta and a “Marketing” group in Jira. When a new user joins the company, they are added to Okta, and their profile contains information about which team they belong to.

As there is an integration between Okta and Jira using the miniOrange app that supports on-the-fly group mapping. The app detects the team information from Okta and checks if a group with the same name exists in Jira. If a group with the same name exists, the user is automatically added to that group, in this case, “marketing” if not, then a new group ‘marketing’ is created in Jira and the users are added.

The above are just a few of the most common use cases but it’s not just limited to that. **Identity Migration**-moving from one IdP to another, **SSO (Single Sign-On)** can be integrated with our SCIM app, **attribute transfer** to a relying party’s website and more. That brings us to…

### How Do IT Administrators Working with Atlassian Applications Benefit? {#benefits-for-it-admins}

Our SCIM integration offers various benefits to Atlassian application users, be it **Confluence, Jira, Bitbucket, or Crowd.** It is a popular solution among IT admins for user provisioning and de-provisioning. One of the main advantages of SCIM is that it **saves licensing costs** as it automates the user provisioning and de-provisioning process. Organizations with a large number of users can reduce the number of licenses needed for applications thus saving a significant amount of money.

The addon ensures that resources are allocated more efficiently as new users are automatically provisioned with the appropriate access rights. miniOrange User Sync/SCIM allows for **granular control** so that users only have access to the resources they need thus **mitigating the risk of unauthorized access.** All leads to **enhanced security** by ensuring that user access is granted or revoked in a timely manner.

Companies can expect an **increase in productivity** as our app eliminates the need for manual user provisioning and de-provisioning so that your IT staff can focus on more critical tasks. The automated process **reduces the risk of manual errors** as well. With these benefits, your business can look to **improve the overall user experience** eventually leading to higher user satisfaction.

### Summary {#summary}

If you are here, that means you took the time to go through the use cases and the overview of our app. No more time-consuming manual onboarding and offboarding users, employees get easy and quick access to the apps they need to work. You get automated access management that not just saves you time but also money.

You could also go through our other apps that compliment ‘lifecycle management’ such as SSO that would work in tandem to keep you secure. So, set up your employees fast with what they need, and unburden your IT team to focus on the bigger picture. Looking for something specific? Please contact us at **support-atlassian@miniorange.atlassian.net** or raise a support ticket [here](https://miniorange.atlassian.net/servicedesk/customer/portal/2), and keep watching this space for more new and innovative solutions.


SCIM an acronym for ‘System for Cross-domain Identity Management’ is a protocol that allows for automated provisioning and de-provisioning of user accounts between different systems. Our app allows seamless login into the Jira, Confluence, Bitbucket, Crowd and other Atlassian.

How miniOrange SCIM Simplifies Centralized IDP User Management in Atlassian Apps


## How miniOrange User Sync/SCIM Automates User Provisioning for Atlassian DC applications {#how-miniorange-user-sync-automates-user-provisioning-for-atlassian-dc-applications}

Managing users in Atlassian manually, especially in situations with large numbers of users, is time-consuming and prone to human error. With employees joining various departments and projects on a regular basis, a lot of time is spent on managing users with the access they need which can lead to users being provisioned incorrectly.

[miniOrange User Provisioning](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) for Atlassian applications comes packed with a variety of powerful features. With the miniOrange User Provisioning app, employee/user accounts can be created, updated, deleted, and given proper access across multiple applications at the same time. The procedure of adding, updating, and deleting users, as well as managing their access, is automated. 

&nbsp;

![user-sync-scim](/blog/assets/2023/user-sync-scim-automate.webp)


When it comes to Atlassian products such as Jira, Confluence, and Bitbucket you can use Just-in-time provisioning provided with the Single Sign-On functionality of Atlassian Data Center. The native SSO functionality of Atlassian allows you to update the users and their groups at the time of SSO login. **However, for most enterprises, this does not fulfill the overall requirement.** 

Atlassian SSO updates users and groups only at the time of SSO (Just in Time Provisioning). 

&nbsp;
 

Most Atlassian customers implementing SAML use the attributes sent in the SAML response to provision users just-in-time. 

 &nbsp;

Using Just In Time (JIT) Provisioning, you receive all group and user information from your Identity Provider. JIT provisioning will remove any existing Jira or Confluence groups that are not in the SSO response. Managing a few groups within Jira or Confluence will never work in this scenario. **If you are manually managing some groups, that will not work with Atlassian SSO. This is one of the shortcomings of Atlassian’s provisioning model and may not be an ideal solution for Enterprises.**

&nbsp;

In this article, we will go over the top provisioning features that you won’t find in Atlassian’s inbuilt User Provisioning in Data Center – but you will find in miniOrange’s User Provisioning App. 

&nbsp;

Let’s see what the miniOrange User Provisioning app offers along with Just-in-time provisioning:
 
- **Real-time provisioning**– your user and group information will get automatically updated every time the user’s data is updated in the Identity Provider. 

- **Sync the User from a particular group or an application** – You can sync users from a particular group or application if you do not want all your users synchronized. Members from only that group will be synchronized. 

- **User Deactivation/Delete from Jira/Confluence** - According to some estimates, approximately 30% of all Atlassian user licenses are unused. This happens because users that leave the organization or change roles don’t have their accounts deactivated in a timely manner. Atlassian users whose accounts haven’t been deactivated can have negative consequences, like exceeding license limits leading to an increase in licensing costs and retaining access from former employees – posing major security concerns.

&nbsp;&nbsp;

**Just-in-Time provisioning cannot be used to deactivate the user since the SSO process involves active user accounts.** You can manually remove the user from the Jira group but it will still consume the licenses. 

With the help of our User Provisioning Add-on, you can **automatically deactivate and delete multiple users** from specific groups. Users can be automatically deleted based on their status in the directory. 

- **Synchronization of User Directories:** the miniOrange User Sync plugin can synchronize entire directories with the help of Real-time provisioning. When user directories are synchronized, new users will automatically be added in the respective Atlassian applications. With User Directory Synchronization you can also sync IDP-specific directories. You can also schedule synchronization which provides proactive provisioning and de-provisioning of users and groups at regular intervals (sync).

- **User name and Group transformation –** Native SSO provisioning requires you to provision the user with the same username as IDP. However, with username transformations, you can associate the provisioning of users with different values. Filtering groups will help you to manage access and permissions within Jira or Confluence easily.

Apart from this, the [miniOrange User Provisioning](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) App offers a wide range of features focusing on provisioning users from your IDP directory into Atlassian Applications. Below is the detailed comparison of the [miniOrange User Provisioning app](https://marketplace.atlassian.com/search?query=miniOrange%20User%20Sync) with native Atlassian. 

### miniOrange User provisioning Features {#miniorange-user-provisioning-features}

1. Supports SCIM 2.0 and SCIM 1.1 protocol	
2. On- the fly group mapping
3. Manual Group Mapping	
4. Default Group Mapping
5. Sync History
6. Provision to map groups from IdP to local groups

**Ready for the action? Install User Sync today!**

 &nbsp;&nbsp;

It’s really easy to manage users via our developed user provisioning add-ons which can be connected with your IDPs ([Azure AD](https://www.miniorange.com/atlassian/jira-scim-user-and-group-provisioning-for-azure-ad), [Okta](https://www.miniorange.com/atlassian/jira-scim-user-and-group-provisioning-for-okta), [OneLogin](https://www.miniorange.com/atlassian/jira-scim-user-and-group-provisioning-for-onelogin), [G suite](https://www.miniorange.com/atlassian/user-and-group-sync-user-provisioning-g-suite/), [Keycloak](https://www.miniorange.com/atlassian/user-and-group-sync-for-keycloak)) or any other SCIM compliance applications so when you setup your Jira Azure AD SCIM or Jira Okta SCIM, user sync plugin will make it a cakewalk for you. Follow the guide to quickly set it up for the Data Center version.

 &nbsp;&nbsp;
 
The add-on also works with [Single Sign On](https://marketplace.atlassian.com/search?query=miniOrange%20Single%20Sign%20On%20) where SSO is used for authentication and User sync application is used for automatic provisioning.


&nbsp;&nbsp;


Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





Managing users in Atlassian manually, especially in situations with large numbers of users, is time-consuming and prone to human error. With employees joining various departments and projects on a regular basis, a lot of time is spent on managing users with the access they need which can lead to users being provisioned incorrectly.

How miniOrange User Sync/SCIM Automates User Provisioning for Atlassian DC applications


In the fast-paced world of e-commerce, staying connected with your customers is essential to ensure a successful online business. One of the most effective ways to keep your customers engaged and informed about their orders is through [SMS and WhatsApp notifications](https://plugins.miniorange.com/shopify-order-and-sms-notifications) on your Shopify store. These instant messaging platforms offer unparalleled convenience and immediacy, enabling you to deliver timely updates and promotions directly to your customers’ fingertips. In this blog, we will explore the benefits of utilizing SMS and WhatsApp notifications and how to implement them seamlessly into your Shopify store.

### The Power of SMS and WhatsApp Notifications {#The-Power-of-SMS-and-WhatsApp-Notifications}

**Real-Time Order Updates**

In the age of instant gratification, customers appreciate knowing the status of their orders in real-time. SMS and WhatsApp notifications allow you to send automated alerts at various stages of the order process, from confirmation and processing to shipping and delivery. This transparency builds trust and fosters a positive customer experience.

**High Open Rates**

Unlike emails that can get lost in crowded inboxes, SMS and WhatsApp notifications have significantly higher open rates. The chances of your message being seen and read are much higher, leading to increased customer engagement and quicker responses.

**Personalized Customer Communication**

SMS and WhatsApp notifications give you the opportunity to customize your messages, addressing customers by name and tailoring content based on their preferences. Personalization enhances the customer experience and helps you build lasting relationships.

**Reduced Cart Abandonment**

By sending timely reminders about abandoned shopping carts via SMS or WhatsApp, you can encourage customers to complete their purchases. These gentle nudges can make a significant impact on your conversion rates.

**Instant Promotions and Offers**

When you have time-sensitive promotions or flash sales, SMS and WhatsApp notifications are the ideal channels to get the word out quickly. This enables your customers to take advantage of exclusive deals before they expire.

### Implement SMS and WhatsApp Notifications on Your Shopify Store {#Implement-SMS-and-WhatsApp-Notifications-on-Your-Shopify-Store}

![sms-notifications-blog-channels-art](/blog/assets/2023/sms-notifications-blog-channels-art.webp)

Now that we understand the benefits of using SMS and WhatsApp notifications, let’s explore how to set up these features on your Shopify store:

**Choose a Trusted Messaging Service Provider**

Begin by selecting a reliable SMS and WhatsApp messaging service provider that integrates seamlessly with Shopify. Look for features such as automation, personalization, and analytics to make the most of your notifications.

**Obtain Customer Consent**

Before sending SMS and WhatsApp notifications, ensure that you have explicit consent from your customers. Add an opt-in checkbox during the checkout process, clearly explaining the purpose and frequency of the messages.

**Craft Clear and Concise Messages**

Keep your notifications brief and to the point. Include essential information such as order status, tracking links, and delivery dates. Avoid overwhelming your customers with excessive messages.

**Segment Your Audience**

Leverage customer data to segment your audience and send targeted messages. For example, you can tailor promotions based on purchase history or location to increase relevance.

**Monitor and Optimize Performance**

Regularly track the performance of your SMS and WhatsApp notifications. Analyze open rates, click-through rates, and conversion rates to identify areas for improvement.

![sms-notifications-blog-flowart](/blog/assets/2023/sms-notifications-blog-flowart.webp)

### Conclusion {#Conclusion}

Integrating SMS and WhatsApp notifications into your Shopify store can be a game-changer for customer engagement and retention. The real-time updates, personalized communication, and high open rates create a positive and dynamic shopping experience for your customers. Remember to follow best practices, obtain consent, and continually optimize your messaging strategy to maximize the benefits. By harnessing the power of these instant messaging platforms, you can elevate your Shopify store to new heights of success in the competitive e-commerce landscape.


Implement SMS &amp; WhatsApp notifications on Shopify. Real-time updates, high open rates &amp; personalized engagement.

Implement SMS and WhatsApp Notifications on Your Shopify Store


## SSO into Jenkins while managing users in Atlassian Crowd

From cell phones to tablets to watches, clients are depending more on the comfort of the versatile innovation of mobile phones because of its easy portability. 

Lately we have seen a huge expansion in the universality of cell phones among people across the globe. These gadgets empower people to introduce a huge collection of tools, known as “applications,” These applications are the quintessence of cell phones, improving their usefulness and upgrading their regular day to day usage. **The application markets permit clients to play out a fast pursuit with establishment of new applications, and yet, they are also a wellspring of various types of malware.** These days, cell phones are dependent upon a wide scope of safety challenges and malevolent dangers.

While adapting to the issue, the objective of this collaboration is to bring you a tad bit nearer to safety and security on mobile phones.

**INFOSYSTA**, the developers of [Mobile for Jira](https://marketplace.atlassian.com/apps/1214475/mobile-for-jira?tab=overview&hosting=cloud) and [JSmobile](https://marketplace.atlassian.com/apps/1219125/jsmobile-service-management-portal?hosting=cloud&tab=overview) are now integrating with **miniOrange’s [Two factor Authentication (2FA)](https://marketplace.atlassian.com/apps/1221260/mo-two-factor-authentication-2fa-for-jira?hosting=datacenter&tab=overview) for JIRA** in their solutions for smartphones.

### Why is Mobile Security a Necessity? {#why-is-mobile-security-a-necessity}

Below are the points why you actually need Mobile Security:
&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp; - Your private data is always protected: It safeguards your data whether it relates to personal, private or public life and ensures that it is under your control everytime. No one can access it without your authorization.
&nbsp;&nbsp;&nbsp; - Your device is protected against malwares: It reduces the chances of viruses and malwares.

### What is 2FA? And How does it work? {#what-is-2fa-and-how-does-it-work}

As found in a lot of news stories about hacks and information leaks, an unprotected password can help cybercriminals access your ledger, charge cards, or gain information on individual sites. 

In any case, the fight isn’t lost. One approach to rapidly support the security of your online records is two-factor authentication — called 2FA — which adds an additional layer of safety to your information.

2FA is a subset of multi-factor authentication. The concept of 2FA is that you need more than just a username and password set to login into an application and if you don’t provide the key to both the factors, authentication fails.

This second factor could emerge out of one of the classifications:

- **Something you know:** This could be a personal identification number (PIN), a password, answers to “secret questions.”
- **Something you have:** Typically, a user would have something in their possession, like a credit card, a smartphone, or a small hardware token.
- **Something you are:** This category is a little more advanced, and might include a biometric pattern of a fingerprint, an iris scan, or a voice print.

It guarantees that regardless of whether your password is exposed to anybody, or on the other hand if it’s stolen through phishing, they will not have the option to get to your information without going through the subsequent factor.  

&nbsp;&nbsp;

**Let’s have a look at the benefits of 2FA:**

- Further developed security: By requiring a second layer of verification, 2FA reduces the chances of getting the data or access under attacks. Regardless of whether a fraudster has access to a password he will not have the subsequent component needed to validate.

- Increase of usefulness and adaptability: Enterprises are accepting 2FA as it adds to a higher level of security. With versatile 2FA methods(SMS/OTP/QR codes), workers can safely get to corporate applications, information, records, and administrative center frameworks from any device or area without putting the corporate organization and data in danger.

![Atlassian Crowd and Jenkins integration](/blog/assets/2023/two-factor-authentication-integration-with-infosysta.webp)

### Our Integration {#miniorange-integration}

Realising the threats of cyberattacks, miniOrange developed **Two factor Authentication** to give applications one additional layer of security over just a password. A security which can only be verified by the person who’s information like mobile number or security questions has been set up. In our add-on, there are multiple ways in which you can set up 2FA on mobile phones.

The methods are as follows:
- Mobile Authenticator
- Yubikey Hardware Token
- OTP over Email
- Security Question
- Backup Codes: As the name suggests this authentication method acts as a backup when the passcode/OTP of the primary method is lost.

And to add to that, **Infosysta** is all set with their mobile applications; **Mobile for Jira and JSmobile** to help users for efficient work portability. 

**Infosysta** has now integrated **miniOrange’s Two Factor Authentication** with their Mobile for Jira and JSmobile applications, which are easy to install, configure and use.

With ease of moving from PCs to your mobile phone plus advanced security with 2FA comes together to give you a supportive system. 

miniOrange provides improved security with 2FA for mobile apps such as Mobile for Jira and JSMobile in collaboration with Infosysta. Infosysta has now integrated miniOrange’s Two Factor Authentication with their Mobile for Jira and JSmobile applications, which are easy to install, configure and use. With ease of moving from PCs to your mobile phone plus advanced security with 2FA comes together to give you a supportive system. 

Integration of Two Factor Authentication (2FA) with INFOSYSTA Mobile Apps


### Q1. What is the miniOrange Oracle EBS SSO & MFA Solution? {# Q1}

**A.** miniOrange has a comprehensive SSO & MFA Solution for the world’s favorite ERP Software – Oracle E-Business Suite. Using miniOrange’s Single Sign-On and Multi Factor-Authentication, you can implement a high quality Identity and Access Management strategy for all your legacy applications.  

miniOrange’s Oracle EBS SSO & MFA Solution connects to your Oracle E-Business Suite instance and establishes trust with your existing identity source such as Microsoft Active Directory, Azure AD, Microsoft ADFS, Oracle DB, Okta or miniOrange IDP. Having this seamless configuration in place, your users can easily access their Oracle E-Business Suite accounts without having to enter their credentials, as miniOrange picks the relevant attributes from their existing Identity Provider session, to authenticate against the FND_USER table in your Oracle EBS Database.


### Q2.What are the different deployment options for this solution? {# Q2}

**A.** miniOrange’s Oracle EBS SSO & MFA Solution is available in two different deployment methods:

1. Cloud-Hybrid Model
2. On-Premise Model
3. Both of these deployment options include the complete suite of miniOrange’s features. The following table summarizes a few key offerings :

|Sr. No	| Cloud-Hybrid Model | On-Premise Model |
|-------|--------------------|------------------|
|1      | Supports miniOrange’s effortless “Pay-as-you-go” licensing method. | Supports miniOrange’s Yearly as well as Perpetual licensing methods.|
|2      | Lightweight connector installation, cloud is entirely managed by miniOrange. | Compliance friendly On-premises installation, zero cloud components involved.|
|3      | miniOrange’s Cloud is Load Balanced by default. | High Availability Setup is Supported free of charge.|
|4      | Supports Seamless Sign-On using miniOrange’s Integrated Windows Authentication module. | Supports Seamless Sign-On using miniOrange’s Integrated Windows Authentication module.|
|5      | Can be extended to support any number of Oracle/other applications. | Can be extended to support any number of Oracle/other applications.|
 

All-in-all, both deployment models come with their own set of convincing advantages. Contact us at idpsupport@xecurify.com to help you choose the right deployment model for your organization.  

### Q3. What does the solution architecture look like for both these deployment options? {# Q3}

**A.** miniOrange’s Oracle EBS SSO & MFA Solution can either be directly installed on the Apps Tier of your Oracle EBS instance, or on its own separate server with miniOrange’s Identity Server. Here’s an architecture diagram for both our deployment options –

#### **1. miniOrange Oracle EBS SSO & MFA – Cloud Hybrid Architecture 1**

![miniOrange Oracle EBS SSO Cloud Hybrid Architecture 1](/blog/assets/2023/cloud-hybrid-architecture-1.webp)  

#### **2. miniOrange Oracle EBS SSO & MFA – Cloud Hybrid Architecture 2**

![miniOrange Oracle EBS SSO Cloud Hybrid Architecture 2](/blog/assets/2023/cloud-hybrid-architecture-2.webp)  

#### **3. miniOrange Oracle EBS SSO & MFA – On-Premise Architecture**

![miniOrange Oracle EBS SSO On-premise Architecture](/blog/assets/2023/on-premise-architecture.webp)  

**Setup steps for miniOrange’s Oracle EBS SSO & MFA Solution : [Link](https://www.miniorange.com/oracle-ebs-single-sign-on-(sso))**

### Q4. Why should I choose miniOrange’s solution for Oracle EBS? {# Q4}

**A.** miniOrange has been recognized as an Oracle Partner under Oracle’s Global Modernized Oracle Partner Network (OPN) program. You can view our partner status in real time [here](https://partner-finder.oracle.com/catalog/Partner/SCPP-KMJAKXYX#profile-solutions).

miniOrange has also been recognized as a Microsoft Partner under the Microsoft Marketplace Partner program. This professional relationship with Oracle and Microsoft makes miniOrange one of the most sought SSO & MFA products, especially for SSO and MFA into Oracle Applications having users stored in Microsoft Active Directory or Azure Active Directory. This seamless integration on both ends makes miniOrange the undisputed market leader.

Oracle has also shown recognition for miniOrange by accepting the miniOrange Oracle EBS SSO & MFA Solution on their Cloud Marketplace. You can view this solution by visiting Oracle’s Cloud Marketplace [here](https://cloudmarketplace.oracle.com/marketplace/en_US/listing/111839538). 

miniOrange is the only Oracle EBS SSO Solution that has ever been accepted on Oracle Cloud Marketplace.

 

### Q5. What will my end user authentication flow look like? {# Q5}

**A.** Here is the end user authentication flow for SSO into Oracle Applications –

- Users will navigate to their bookmarked Oracle application URL (or a custom URL for the authentication method, depending on the application).
- The Oracle application will check if the user is authenticated (or not).
- If the user is authenticated, they will be granted access to the application. If not, they will be redirected to the login screen for your enterprise Identity Management solution; this will be handled by the miniOrange Oracle EBS SSO & MFA Solution, which communicates with your IdP (Identity Provider) via SAML/OpenID Connect/other SSO protocols.
- Users will enter their credentials at the Identity Provider login screen; the credentials for authentication can be decided by you, depending on which authentication system you’re using (Microsoft Active Directory, Azure AD, ADFS, any other Identity Provider, a third-party application/database like Oracle DB).
- Once they’ve been authenticated, the user will be redirected to the resource that they were initially trying to access.
- Once a user has already authenticated with your Identity Provider for one Oracle application, they won’t need to enter their credentials again for accessing another Oracle application, or any other application which can pick up the existing session of the user in the chosen identity source.###

&nbsp;  

&nbsp;

#### **More Resources:**  

1. [miniOrange’s Complete Suite of Oracle Solutions](https://www.miniorange.com/integrations/oracle-single-sign-on-sso)
2. [Steps to setup SSO into Oracle EBS](https://www.miniorange.com/oracle-ebs-single-sign-on-(sso))
3. [Oracle EBS – miniOrange – Azure AD SSO Blog](https://blog.miniorange.com/oracle-ebs-sso-integration-with-azure-ad/)

Setup SSO into Oracle EBS using miniOrange’s Oracle EBS SSO solution using any Identity Provider of your choice.

Cloud Hybrid & On-Premise Deployment Options for miniOrange’s Oracle EBS SSO & MFA Solution


### How to use Single Sign-On for your ASP.NET MVC application? {#how to use single-sign-on for ASP.NET MVC application}

There may come a time when you need to implement [Single Sign-On onto your ASP.NET MVC application](https://plugins.miniorange.com/asp-net-saml-single-sign-on-sso). It allows you to integrate your app with other systems and helps them work together as if they are one unified application.

Some of the benefits of doing this are an improved user experience, increased security, and reduction in costs. Users will be able to seamlessly access pages on any of these applications or systems after signing in only once.

Or, if you want to migrate your application, rather than having to rewrite it entirely, you can migrate it one service at a time. Implementing SSO between the two applications helps you effectively link them together as if they were one, after which you can migrate your app with ease. There are even more advantages discussed later in this article.

To understand how you can implement [ASP.NET MVC Single Sign On](https://plugins.miniorange.com/asp-net-saml-single-sign-on-sso), let us first understand what its components mean.

### What is ASP.NET MVC? {#what is ASP.NET MVC}

ASP.NET MVC is composed of two parts: ASP.NET and MVC. The first is an open-source web application framework that can be used to produce dynamic web pages, applications, and services. The second is MVC, which stands for Model View Controller. It is an architectural pattern that is meant to achieve separation of concerns. 

Together, they form a web application framework that eliminates the drawbacks of web forms like slow response times, issues in unit testing, and HTML customization.

Designing your application using the ASP.NET MVC framework allows you to benefit from both its components’ advantages. However, you still need to make it easier for users to sign in to your application and avail of its services in a hassle-free manner. Let’s see how we can do that.

 ### What is SSO? {#what is SSO}

 When a user wants to access secured services on your application, they have to enter their username and password once to authenticate themselves. In a situation where they want to access similar services over multiple applications connected or related to each other, they would be required to enter either the same or different usernames and passwords multiple times.

 ![what-is-single-sign-on-and-how-sso-works-4](/blog/assets/2023/what-is-single-sign-on-and-how-sso-works-4.webp)

 Single Sign-On (SSO) makes this process easier by using the same authentication ID and authorizing the user across multiple services. Because of SSO, as the name suggests, the user is required to sign in only once in a certain time window before the authentication token expires.

 ### What are the types of SSO protocols? {#what are the types of SSO protocols}

 For SSO to work, Service Providers (SP) and Identity Providers (IDP) must decide on an open standard protocol for how they will choose to exchange identity and authentication information with one another over the relevant applications.

 Here are a few examples of these protocols: 

 **OAuth**: This is an open standard for token-based authentication and authorization, which is used to provide Single Sign-On (SSO). It allows an end user’s account information to be used by third-party services without exposing the user’s password. It serves as an intermediary on behalf of the end-user, providing the service with an access token that authorizes specific account information to be shared.

 **OpenID**: This is one of the most popular authentication protocols, used by the likes of Google and Facebook. It is open standard and decentralized. Third-party Identity Providers (IdP) are used to authenticate users to Relying Parties (RP). It serves as an identity layer on top of OAuth, thereby functioning as an extension to it.

 **SAML**: SAML uses session cookies in a browser that allows a user to access certain pages. It gives more control to enterprises to keep their SSO logins more secure. You can find a detailed explanation of SAML below.


### Let’s take an in-depth look at SAML {#in-depth look at SAML}

SAML stands for Security Assertion Markup Language. Its main purpose in online security is to enable you to access multiple web applications using one set of credentials. It works by passing authenticated credentials between two parties: an Identity Provider (IDP) and a Service Provider (SP). Doing so makes the user experience simpler while also providing better security.

 ![saml-diagram-2](/blog/assets/2023/saml-diagram-2.webp)

 ### Where can we use SAML SSO? {#where can we use SAML SSO}

The primary attribute of SAML is that it is used for authentication, not authorization. This means that a variety of applications, websites, and services that could be used to access and edit data from the service provider need to form a trusted relationship with the SSO website.


Now, when a user tries to access data from the service provider’s app, they’ll need to be authenticated at least once by entering a username and password before they can read or write onto this data. If, however, they have already done this once, then they will be granted access more directly. A SAML request will be generated by the application, asking to authenticate the user, to which the identity provider will respond with a SAML response.


This is particularly useful in situations where the service provider is offering their services across a wide range of applications. It inadvertently also increases the scope of the product by allowing a variety of third-party applications to offer their unique services using the same data.

For example:
- Data-driven statistics websites and applications for online multiplayer games.
- Social media applications and bulletin boards designed around the same topic.
- Online video streaming services with features for viewer engagement.
- Online software marketplaces like Steam that offer user analytics and metadata.

### What are the benefits of using ASP.NET MVC Single Sign On? {#benefits of using ASP.NET MVC Single Sign On}

**Shorter development time**: Using ASP.NET MVC Single Sign-On reduces development time by providing developers with a common authentication framework. It takes even more load off of them if the mechanism is independent.

**Reduction in costs**: Besides the fact that development time is reduced, support requests for forgotten passwords and IT help desk calls also go down, thereby lowering the overall costs.

**Increased security**: An important benefit of SSO is that it reduces the chance of users falling prey to phishing attacks. This is because the user is not trained to mindlessly enter their username and password everywhere. Furthermore, SSO systems usually force users to use secure communication channels. This means that only one place of authentication receives their credentials. The applications, however, don’t receive any specific information besides whether they should let the user in or not. This happens only once, resulting in a minimum transfer of sensitive information, which is naturally favorable.

**Streamlined administration**: The burden on the administrative system to manage user accounts is massively reduced with the implementation of SSO. Keep note, however, that SSO only takes care of authentication. The authorization of users based on their access privileges still needs to be set up separately.

**Improved user experience**: With ASP.NET MVC Single Sign On enabled, users don’t have to enter their usernames and passwords multiple times to access the same service across multiple applications and browsers.

### Additional Sources: {#Additional sources}
- [What is Single Sign-On (SSO)?](https://www.miniorange.com/products/single-sign-on-sso)
- [What is ASP.NET SAML Single Sign-On (SSO)?](https://plugins.miniorange.com/asp-net-saml-single-sign-on-sso)
- [Steps to Configure the ASP.NET SAML 2.0 Module](https://plugins.miniorange.com/asp-dot-net-saml-2-0-single-sign-sso-connector#steps)
- [Setup Steps for ASP.NET SAML SSO Module](https://plugins.miniorange.com/asp-net-saml-sso-setup-guides)





How to use Single Sign-On for your ASP.NET MVC application?


## SSO into Jenkins while managing users in Atlassian Crowd

![Atlassian Crowd and Jenkins integration](/blog/assets/2023/atlassian-crowd-and-jenkins-integration.webp)

Jenkins manages and controls software delivery processes throughout the entire lifecycle, including build, document, test, package, stage, deployment, static code analysis, and much more. To make Jenkins application access easier and provide better security we have an [SSO module](https://plugins.miniorange.com/jenkins-saml-single-sign-on-sso) that can be integrated with Jenkins easily and deployed on Jenkins platforms with some of the most important features like **Just-In-Time User & Group Provisioning**, **Auto Redirect to IdP**, **Signing & Encryption**, **Custom User Attribute Mapping**, **Single Logout**, **Manual Group & Role Mapping** and many more. 

Atlassian Crowd is a powerful tool that enables users to create sessions for multiple Atlassian products like Jira, Confluence, Bitbucket. The Crowd is a centralised identity for access management application that manages the users from various directories like Active Directory, LDAP, Open LDAP, Microsoft Azure Active Directory for connected applications. These capabilities can now be applied to Jenkins as Crowd connector for Jenkins.

Now, enterprises are looking to delegate user authentication for the applications from Crowd to central IAM (Identity & Access Management) applications for better security. But Crowd is still required to manage users and permissions. This use-case is possible with the help of connectors we have developed for these Atlassian applications like [Jira](https://marketplace.atlassian.com/apps/1220053/mo-sso-connector-for-crowd-and-jira?hosting=datacenter&tab=overview), [Confluence](https://marketplace.atlassian.com/apps/1220055/mo-sso-connector-for-crowd-and-confluence?hosting=datacenter&tab=overview), and [Bitbucket](https://marketplace.atlassian.com/apps/1220057/mo-sso-connector-for-crowd-and-bitbucket?hosting=datacenter&tab=overview). Jenkins, however, is a non-Atlassian application, thus integrating this flow with Jenkins is difficult. 

![Atlassian apps and Jenkins integration](/blog/assets/2023/atlassian-apps-and-jenkins-integration.webp)

### How does the miniOrange plugin handle this use case? {#miniorage-plugin-solution}

miniOrange haS developed a [Jenkins Crowd SSO Connector](https://miniorange.atlassian.net/servicedesk/customer/portal/2) capable of creating user sessions by reading the Crowd session. Like any other Atlassian application like Jira, Confluence and Bitbucket, you can manage groups and permissions from the Crowd. You can authenticate to the Crowd via SAML SSO using the [Crowd SAML SSO](https://marketplace.atlassian.com/apps/1218304) plugin. With the help of Jenkins Crowd SSO connector, you can invoke SSO from Jenkins itself. You do not need to login into Crowd explicitly.

### How does it work? {#how-does-it-work}

Crowd SAML SSO Plugin acts as a SAML Service Provider and is used to enable trust between Jenkins and the central IAM applications. Crowd SAML SSO plugin takes care of the SAML Request, SAML response, and user session management at the Crowd end. Once the Crowd session is created, Jenkins reads this session and the user is logged in to Jenkins. Users can invoke SSO from Jenkins itself.

Here, IAM will perform the user authentication. The crowd will be used to manage users and their groups (permissions) for all the connected applications.

Also, with this flow, end-users will experience a seamless login and won’t notice that the SSO request and response passes through the Crowd Server.

**Let’s understand the Workflow!**

1. The user tries to access the Jenkins application.
2. For authentication, the users would get forwarded to the IAM application’s login page.
    1. The Jenkins Crowd SSO Connector will redirect users to the Crowd SAML plugin.
    2. The Crowd SAML plugin will forward the user to the IAM application for authentication.
3. Once the authentication is successful, the user will be redirected back to the Jenkins application and logged in.
    1. IAM sends a response back to the Crowd SAML plugin.
    2. Crowd SAML plugin validates the user creating the user session, and redirects the user to the respective application form where the SSO was invoked.
    3. Users will be granted access to Jenkins based on their groups and applications configured on Crowd.

![Atlassian apps and Jenkins integration](/blog/assets/2023/jenkins-crowd-connector-workflow.webp)

### What are the Key Benefits? {#what-are-key-benefits}

1. There is only one set of SAML configurations for all the Atlassian & Non-Atlassian applications.
2. User authentication moved to central IAM without losing any of the existing user permissions.
3. Users will be able to access all the connected applications using their IAM credentials.
4. This method makes it simple to add an extra security layer, such as MFA, on top of the SSO, which was not available while utilizing Crowd for SSO.

What do you think of this solution? Do you think this would be helpful in centralizing authentication for your users? Drop us a mail at [info@xecurify.com](mailto:info@xecurify.com) or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.

miniOrange Jenkins Crowd SSO Connector is capable of creating user sessions by reading the Crowd session.

SSO into Jenkins while managing users in Atlassian Crowd


### Why is Thinkific popular among users? {#why-is-thinkific-popular-among-users?}
Thinkific provides a platform that allows businesses or people to create and deliver online courses without any design or technical expertise. It allows its users to use their existing resources to set up online courses using an easy-to-use interface. Thinkific offers tools for setting up courses, managing students, payments, and marketing to reach a bigger audience. It’s a one-stop-shop for all your Online Course needs.  

Typical customers of Thinkific are Freelancers, Small businesses, Mid-size businesses, and large enterprises and to provide them with more exclusive and various features- Thinkific provides [3rd party applications](https://apps.thinkific.com/) which can be configured and installed to your Thinkific Website to deliver the best experience for students and online education.  

Not providing an interface to use existing user sessions or credentials leads to a bad user experience as users have to remember and enter credentials each time they want to access their applications, this is where [SSO for Education](https://www.miniorange.com/iam/solutions/identity-management-for-k12) comes into the picture. [Single Sign-On (SSO)](https://www.miniorange.com/thinkific-jwt-single-signon(sso)-solution) is an authentication service that allows a user to access multiple applications (such as [Microsoft Apps](https://www.miniorange.com/iam/integrations/microsoft-365-sso), [Google Apps](https://www.miniorange.com/google-apps-single-sign-on-(sso)), [Oracle EBS](https://www.miniorange.com/iam/integrations/oracle-single-sign-on-sso), and many more)  using a single set of credentials. This prevents the need for the user to log in separately into the different applications. Using SSO the end user only has to remember one set of credentials to access all the applications. Users can be anywhere, in miniOrange, any external IDPs ( such as Azure AD, Okta, etc ), or in any user directory such as AD, LDAP, etc and they don’t have to migrate their credentials.  

In addition to [SSO](https://www.miniorange.com/blog/what-is-single-sign-on-sso/), users will have one-click access to all their apps and will never be locked out by mistake. On top of SSO, [Two-Factor authentication](https://www.miniorange.com/two-factor-authentication-(2fa)) makes it easier for users and organizations to safeguard and prevent security breaches as it adds an extra layer of security to their applications.

![Thinkific Single Sign-On SSO](/blog/assets/2023/thinkific-sso.webp)

### Challenges faced by Thinkific Users {#challenges-faced-by-thinkific-users}
Since the internet has become a crucial part of schools and educational institutes, it is now a challenge for these institutes to manage logins for such a large number of users, whether it be Thinkific or any other online platform.  

Schools or colleges usually have an existing application/site where student credentials are already stored. Now to log into Thinkific or any other online app, students want seamless access to their app portal through their existing accounts. Students do not wish to have a separate set of credentials for logging into Thinkific.  

Now to overcome this problem, Thinkific allows its users to use their existing credentials to log in to their Thinkific platform using JWT (JSON Web Token). An interface needs to be created by administrators to generate that JWT token and log the users into Thinkific using their existing credentials. Administrators don’t always have the control or the resources to generate such an interface.

![Thinkific SSO Authentication](/blog/assets/2023/thinkific-sso-authentication.webp)

### miniOrange Single Sign-On (SSO) Solution for Thinkific- What can it do for you? {#mini0range-single-sign-On-sso-solution-for-thinkific}
miniOrange helps you simplify everyday teaching and learning experience for students, teachers, and staff by providing you a seamless Single Sign-On (SSO) solution for apps like Thinkific.  

To streamline [Thinkific SSO integration](https://www.miniorange.com/thinkific-jwt-single-signon(sso)-solution), miniOrange has a ready-made solution that users can use to authenticate themselves using their existing credentials and log into Thinkific. Users just have to click on a link and based on the Identity Provider or User stored configured in miniOrange are redirected to the appropriate login page / Identity Provider for authentication. After successful authentication, [miniOrange](https://www.miniorange.com/iam/) constructs the necessary token and automatically redirects the user to Thinkific.  

Thinkific deconstructs this payload and either finds the user and signs them in, or if they don’t already have an account on your Thinkific site, creates an account and signs them in. Using Single Sign-On (SSO) for Thinkific or any education platform will allow students, teachers, and administrators to instantly log in to these resources, with just a single login to the dashboard.

![Thinkific Single Sign-On SSO Flow](/blog/assets/2023/thinkific-sso-flow.webp)

 
If you are using multiple on-premise and cloud-based apps, miniOrange provides a single sign-on platform with many [supported integrations](https://www.miniorange.com/iam/integrations/) for a simple and secure way for your students to sign in.


### Here are some Popular Integrations with Thinkific {#here-are-some-popular-integrations-with-thinkific}

**Azure AD Integration with Thinkific**  
If you are looking to connect AzureAD with Thinkific then you just have to configure miniOrange as a client in AzureAD and connect miniOrange with Thinkific. You can check the following documents to get started: [Login Using Azure AD](https://www.miniorange.com/iam/login-with-external-idp/configure-azure-ad-sso)  

**Okta Integration with Thinkific**  
If you are looking to connect Okta with Thinkific then you just have to configure miniOrange as a client in Okta and connect miniOrange with Thinkific. You can check the following documents to get started: [Login Using Okta](https://www.miniorange.com/iam/login-with-external-idp/configure-okta-sso)

**LDAP / Active Directory with Thinkific**  
If you are looking to connect LDAP / AD with Thinkific then you just have to configure your Active Directory as a User Store in miniOrange and connect miniOrange with Thinkific. You can check the following documents to get started: [Directory Services](https://www.miniorange.com/products/directory-services)

 

### Benefits Of Using Single Sign-On (SSO) For Thinkific {#benefits-of-using-single-sign-on-sso-for-thinkific}
**Seamless User Experience:** Give students, teachers, alumni, and employees a simple online experience while minimizing queries related to authentication.  

**Manage users with ease:** Add or remove users with just a few clicks, As you have to make changes in only one user directory rather than multiple sources.  

**User Life-cycle Management:** Easily manage user life-cycle with the transition of a user from one group to another. e.g. Student to Alumni, Undergraduate to Postgraduate.  

**Reduced support cost:** Remembering fewer passwords means reducing support dependency and thus reducing the cost of support.  

**Extensible:** With support to [5000+ applications](https://www.miniorange.com/iam/integrations/) ([Zoom](https://www.miniorange.com/zoom-us-saml-single-sign-on-solution), LMS apps, etc) already and growing, Scale-Up or Scale-Down adaption of applications without any hassle.  

**Platform Independent:** Seamless access over all devices supporting a web browser.  

&nbsp;  


#### **How much am I going to pay for this?**
miniOrange believes that Institutions and colleges should not face high implementation costs for securing their applications or websites. Their data and credentials should be protected at ease without rendering or affecting their learning process.  

Hence, miniOrange provides a secure and seamless remote learning experience at affordable prices.  

Single Sign-On (SSO) seamless solution is provided to educational institutions along with 24*7 Technical Support. We are trusted by educational institutes across the globe like Harvard University, Stanford University, the University of Florida, and [many more](https://www.miniorange.com/customers?id=educational-institutes).  

Integrate and test the Community Version [free of charge](https://www.miniorange.com/iam/on-premise-identity-server/download).

### Conclusion {#conclusion}
The bottom line is Students and Teachers will be relieved from maintaining multiple credentials to access various applications. Take advantage of the ready-made solution that miniOrange is providing to Thinkific users so that they can enjoy a seamless and secure login experience to their accounts from their existing Identity Providers / User Stores or from miniOrange.  

&nbsp;  

&nbsp;  



#### **Further Reading**  

- [Thinkific SSO MFA integration with multiple IDPs](https://www.miniorange.com/iam/integrations/thinkific-sso-mfa)
- [Add an extra layer of Security to your Thinkific account](https://www.miniorange.com/two-factor-authentication-for-thinkific)
- [What is Single Sign-On?](https://www.miniorange.com/single-sign-on-sso)
- [How to manage Students or Users?](https://www.miniorange.com/user-provisioning)
- [Single Sign-On (SSO) For Your Application Using Azure AD](https://idp.miniorange.com/login-using-azure-ad/)

miniOrange is providing a ready-made Single Sign-On (SSO) solution to Thinkific users to enjoy a seamless and secure login experience to their accounts from their existing Identity Providers / User Stores or from miniOrange.

Thinkific Single Sign-On (SSO): Secure Best Online Course Platform


## User Provisioning App : Keeps you in sync with multiple Atlassian applications! {#keeps-you-in-sync-with-multiple-atlassian-applications}

[Advanced Option for Atlassian SSO Plugin](https://marketplace.atlassian.com/apps/1229209/advance-options-for-atlassian-sso?hosting=datacenter&tab=overview)

Picture this: You have 1000s of users. Each user accesses multiple atlassian applications like Jira and Confluence and some of them keep facing issues with user access, activation and deletion which by the time you resolve, you have another pile waiting for you. Sounds familiar? 

&nbsp;&nbsp;

How are you going to manage user provisioning and de-provisioning and access of every user for each application? Manually managing large numbers of users is equivalent to putting out fires all day long. We’ve got you covered with our User Provisioning /SCIM add-on, which can help you to handle your users/employees instantly and effortlessly across atlassian applications for Jira SCIM and Confluence SCIM. Wondering how is it possible? We will help you to understand exactly how it can be done.

### What is User Provisioning and Deprovisioning? {#user-provisioning-and-deprovisioning}

User Provisioning is the process of creating, updating and/or deleting a user’s account and access through multiple applications at once. In our particular case this user sync or SCIM can be applied to Atlassian applications for Jira User Sync and Confluence User Sync. Provisioning provides information about users / employees such as their name, attributes, groups and other relevant data allowing them to grant or revoke access as required. Some of the real time examples like hiring, promotions, transfers can set off provisioning. Provisioning ensures user’s access rights are up to date, without manual efforts for each user across all applications.

&nbsp;&nbsp;


### Why is User Provisioning / Deprovisioning important? {#Why-is-user-provisioning-deprovisioning-important}

- Automatically create, update, deactivate or activate user accounts across applications.
- Saves time, manages users directory at one place and keeps everything else sync with directory.
- Automatically assign role-based permissions within apps
- Ensure the prevention of unauthorized access by automatically revoking access to all apps at once – de-provisioning.

### Ready for the action? Install User Sync today! {#ready-for-the-action-imstall-user-sunc-today}

- It’s really easy to manage users via our developed user provisioning add-ons which can be connected with your IDPs (Azure AD, Okta, OneLogin,G suite, Keycloak) or any other SCIM compliance applications so when you setup your Jira azure AD SCIM or Jira Okta SCIM, user sync plugin will make it a cakewalk for you. Follow the guide to quickly set it up for the Server or Data Center version.
- The add-on also works with Single Sign On where SSO is used for authentication and User sync application is used for automatic provisioning.

 
Contact Us – Drop us a mail at **info@xecurify.com** or [raise a ticket here](https://miniorange.atlassian.net/servicedesk/customer/portal/2) to talk to us.





User Provisioning is the process of creating, updating and/or deleting a user’s account and access through multiple applications at once. In our particular case this user sync or SCIM can be applied to Atlassian applications for Jira User Sync and Confluence User Sync.

User Provisioning App : Keeps you in sync with multiple Atlassian applications!


Deprovisioning is the process of automatically removing a user’s access from numerous SAAS app accounts and network infrastructure at the same time. Deprovisioning safeguards the security and confidentiality of the company by prohibiting departing employees from using corporate resources. The Deprovisioning action is triggered when an employee quits their job or changes roles within the company.


It is an [Identity and Access Management (IAM)](https://blog.miniorange.com/what-is-iam-identity-and-access-management-system/) solution that monitors and maintains a user’s identity and attributes in relation to their access to resources across one or more systems.

Consequently, whenever a person is “deprovisioned,” their identity, assets, and all associated accounts within the organization’s network of apps and services are all automatically erased. As a result, all the granted permissions and authorizations are securely revoked.

### Why is Deprovisioning important? {#why-is-deprovisioning-important}

Employees, independent contractors, suppliers, and partners constantly enter and exit businesses, acquiring access to countless tools and programs in the process. However, they must be appropriately offboarded and deprovisioned each time they are transferred to a different area of the organization or depart the business. Deprovisioning has several advantages, some of which are listed below:

**1. Protects data from misuse** 
Suppose an employee has access to some confidential information. Until their access is revoked, they can still access this information even after leaving the company. Therefore, It’s crucial to deprovision access as soon as a former employee leaves the organization since they pose great security threats if it’s not done correctly.

**2. Removes orphaned accounts**
If an employee account is not deprovisioned properly after offboarding, it leads to orphaned accounts. These accounts contain all the information about the former employee which isn’t currently assigned to anyone. Deprovisioning removes such accounts which may become hotspots for cyber attacks if not handled correctly.

**3. Easily update or offboard employees**
Maintain, update and delete employees’ user attributes, such as usernames, roles, and profiles, and automatically assign access permissions and user accounts based on changes in their designation (promotion, change in teams/role, etc.) or simply remove the employee after they leave the company throughout the system.

**4. Eliminate human error**
Because automated provisioning eliminates manual processes, it also greatly reduces the margin of error. When removing a user from the system and revoking access, there’s less of a possibility of making a mistake with the help of deprovisioning.

### How does it work? {#how-does-it-work}

Deprovisioning deletes the accounts connected to the user and eliminates their access permissions when they are offboarded or change roles. Moreover, this procedure may now simply be automated, as opposed to the traditional one that included HR staff relaying information to the IT department and then system administrators to restrict access. Through the use of Identity and Access Management (IAM) technology, automated deprovisioning is possible.

![SCIM User provisioning](/blog/assets/2023/scim-user-provisioning.webp)

The user will be deleted (if terminated) and all accounts linked with them will be immediately modified or revoked when employees move to another department or leave the business with the help of IAM and integrated directories.

### Automated Provisioning and deprovisioning {#automated-provisioning-and-deprovisioning}

Manual Deprovisioning carries significant security risks. There may be times when the person in charge of deprovisioning delays the task or, on rare occasions, forgets to do so. Old accounts with plenty of rights continue to build up in the directory as a result, and many former employees still have active accounts in your company’s domain. Data leaks by former employees shouldn’t be unexpected in this circumstance.

[Automated deprovisioning](https://blog.miniorange.com/automated-user-provisioning/) can assist in avoiding these risky mishaps and removing human error, which can be expensive for your company. A user account is automatically deprovisioned, removing it from Active Directory and revoking all user rights. The process of adding, updating, and controlling their access must also be automated as part of automated provisioning. In comparison to the time-consuming manual method, the activity just takes a few minutes, and it significantly improves network security.


### Provisioning and Deprovisioning with miniOrange {#provisioning-and-deprovisioning-with-miniOrange}

With miniOrange and our wide range of [User Provisioning & Deprovisioning solutions](https://www.miniorange.com/products/user-provisioning), you can create, manage, & delete your external and internal users’ access to on-premises, cloud, and hybrid apps.

We also have pre-integrated apps for Provisioning and Deprovisioning:

-  [Azure/Active Directory](https://www.miniorange.com/azure-ad-provisioning)
-  [G-Suite App](https://www.miniorange.com/google-workspace-provisioning)
-  [Microsoft 365](https://www.miniorange.com/office-365-provisioning)
-  [Salesforce](https://www.miniorange.com/salesforce-provisioning)

![Deprovisioning apps](/blog/assets/2023/automated-provisioning-apps.webp)

Linked is an overview of our Provisioning solutions as well as in-depth steps to implement the solution. miniOrange can set up complete automation for User Provisioning in your organization in no time! We have both cloud and on-premise solutions available based on the organization’s requirements.

Check out all of our pre-existing Provisioning & Deprovisioning integrated apps [here](https://www.miniorange.com/iam/integrations/?id=provisioning).

### Additional Resources {#additional-resources}
- [What is Provisioning?](https://blog.miniorange.com/what-is-provisioning/)
- [JIT Provisioning](https://blog.miniorange.com/what-is-just-in-time-jit-provisioning/)
- [Watch a Video to understand more about User Provisioning & Deprovisioning](https://www.youtube.com/watch?v=No8cg_qMrR4)

Deprovisioning ensures that the former employees do not have access to the organization’s resources right at the moment that they leave.

What is Deprovisioning & why is it important?


**Out Of Band Authentication (OOBA)** is a type of two-factor authentication (2FA) that demands a secondary verification method delivered over a different communication channel (call or text) in addition to the typical user ID and password. The possibility of compromising the transaction/account decreases by splitting the process into two channels, employing both the user’s internet and mobile wireless connection. An attacker is unlikely to be able to compromise both channels in the short amount of time required for an online transaction to take place.

Financial firms and other companies with high-security requirements employ out-of-band (OOB) authentication to prevent unwanted access. OOBA improves cybersecurity by making it more difficult to hack an account because it requires two different and unrelated authentication channels to be compromised at the same time for an attacker to get access.

### How Does Out-of-Band Authentication (OOBA) Work? {# How Does Out-of-Band Authentication (OOBA) Work?}

The channel used to authenticate a customer in an out-of-band authentication (OOBA) system is completely independent of the channel used by the customer to log in or make a transaction. Out-of-band authentication, as opposed to multi-factor authentication, is a sort of 2FA (something you know, like a password, and something you have, like your mobile device).  

Let’s imagine a customer wishes to do a banking transaction on their computer. They use their username and password to access the online banking system. The system then sends a one-time password (OTP) to their mobile device by text message or push notification. The user’s internet and wireless network are both involved in this scenario.  

Malicious actors may have access to compromised credentials and use a laptop to make a transaction, but they rarely have access to the user’s smartphone to obtain the one-time password required for authorization unless additional means like call forwarding, cloning, phone theft, or other ways are used. The transaction cannot be completed without the OTP. Other Out-of-Band Authentication techniques, such as a fingerprint scan or QR code, could be used instead of an OTP by the company.

![Out Of Band Authentication Working](/blog/assets/2023/how-ooba-works.webp)  

### How is OOBA more beneficial than other authentication methods? {#How is OOBA more beneficial than other authentication methods?}

Using [Two-factor authentication (2FA)](https://www.miniorange.com/products/two-factor-authentication-(2fa)) for Out-of-Band Authentication may appear to be a hassle to you; as you have to go through an extra step to log on to your accounts and access resources. Traditional authentication does not work in this fast-paced digital environment when cyber criminals are seeking critical consumer data. You might be leaving yourself open to thieves who want to steal your data and personal information if you don’t use 2FA Security.  

Out-of-band authentication is critical in [identity and access management](https://blog.miniorange.com/what-is-iam-identity-and-access-management-system/) because it significantly minimizes the risk of a “man-in-the-middle” attack. Hackers can intercept data transferring channels by taking over the communication channel between the sender and the recipient in an MITM attack.  

In access management, using two different channels to authenticate lowers the risk of MITM attacks and keeps the transmitted information safe.

### Key benefits of using Out Of Band Authentication (OOBA) {#Key benefits of using Out Of Band Authentication (OOBA)}

#### **Fraud Prevention**
Before allowing you to proceed, [Multi-Factor Authentication](https://www.miniorange.com/products/multi-factor-authentication-mfa) confirms that you are who you say you are. It adds another degree of protection to your website, preventing unwanted access. 

#### **Improved Customer Trust**
Multi-factor authentication (MFA) adds an extra layer of security to your business and your customers’ accounts. It safeguards customer information against identity theft.  

#### **Enhanced Security**
MFA reduces the likelihood that an attacker will be able to impersonate a user and obtain access to the system. The miniOrange MFA solution allows users to log in using only their Username and OTP, eliminating the need for a password.  

#### **Adaptability for different use cases**
When dealing with sensitive data, more caution is necessary. The adaptive MFA evaluates risk based on factors including geo location, IP address, and time since the previous login.  

&nbsp;  

As a result, out-of-band authentication (OOBA) is utilized to secure your devices, accounts, and data from security breaches, phishing, and brute-force password attempts. Knowing the password alone isn’t enough for cyber attackers to pass the security check if you’ve set 2FA protection.  


### How can miniOrange help you? {#How can miniOrange help you?}

miniOrange Authentication Service verifies that you are who you claim to be before letting you move forward. We ensure that however varied your user base may be, we have the right authentication method for each one of them.  

&nbsp;  

**OOBA**: OTP/Link over SMS/EmailOTP over text/call using SMS/Email: miniOrange offers OTP via SMS/Email via the default gateway, which users can access. The templates for sending OTP to your users by SMS and email are entirely customizable as well.  

&nbsp;  

**Link over SMS/Email**: When this option is enabled, you will receive an SMS/email containing an Accept Link and a Deny Link at the moment of verification. If you click the Accept button, your transaction will be completed; otherwise, it will not.  

&nbsp;  

**OOBA Push NotificationPush notifications**: When the push notification mechanism is enabled, you will receive a push notification from miniOrange on your Authenticator App, which you either accept or deny. You can successfully finish the second-factor challenge after clicking Accept.  

&nbsp;  

**Authenticator apps**: Receive a time-based OTP token (TOTP) by an external authenticator app such as Google/Microsoft authenticator for secure login.  

&nbsp;  

**Hardware Token**: Use of a physical USB token in your computer, which generates the required information to gain access.  

&nbsp;  

For any firm or organization trying to increase security, using multiple authentication methods is a clear choice. It secures client information and protects against security breaches. It benefits everyone: customers are less likely to have their data stolen, and organizations are less likely to suffer a significant data breach.  

&nbsp;  

&nbsp;  

#### **Further Reading:**
1. [Multi-Factor Authentication](https://blog.miniorange.com/what-is-multi-factor-authentication-mfa/)
2. [The necessity of Banking Cybersecurity](https://blog.miniorange.com/necessity-of-banking-cybersecurity/)
3. [What is Risk-Based Authentication?](https://blog.miniorange.com/what-is-risk-based-authentication/)

Out Of Band Authentication (OOBA) is a type of 2FA that uses a secondary verification method delivered over a different communication channel.

What is Out-Of-Band Authentication (OOBA)?

### What is Provisioning? {#what-is-provisioning}
Provisioning in its very essence has a very simple meaning – supplying with / making something available.  

As we expand and try to understand this word from an Information Technology business perspective, the definition gets more nuanced. It refers to an IT process involving some infrastructure enabling data and asset transfer.  

As we go on even further and look at it from an [Identity and Access Management (IAM)](https://www.miniorange.com/what-is-iam-identity-and-access-management) perspective for business, it takes up the meaning of an identity management process that overlooks the changes in data of identities and assets in **identity stores.**  

User provisioning **creates, updates, deletes, handles** all identities (user accounts) across all connected IT Infrastructure, applications, data and assets for business.  

- If all employers were to sit down to manage every employee / user account across every business application or network and service manually / individually, they would quickly go **out of business**. Provisioning, or “User Provisioning” enables **seamless and automated** control over all information updates and data that is required to be made when there is some change in data of a group of users – there might be **address updates, account disables, new enrollments/creations, permission management**, the list is endless for user management.
- It is estimated that in a business, an average-efficient IT department will take ~30 minutes to set up an employee account for every new hire, which is an enormous amount of time when scaled to hundreds of joinees. Not to mention the existing employees requiring security and attention on their accounts. This time can be **greatly reduced** by using User Provisioning processes.
- If an organization or business has ~15 business applications and assets across which it has accounts created for its employees / users, even if 5 employees / users leave, the IT department will need to delete ~50 user accounts across all these applications **manually**, which is clearly a big problem waiting to be solved. **The solution is User Provisioning**. It can be set up in a way that **triggers necessary actions on data** when particular changes are made. Like most good automation solutions today, it takes care of the most chaotic problem we face – human error. A problem without a pattern is very dangerous and any solution to it is instantly adopted.
- User Provisioning also greatly helps in improving the **security and onboarding experience** of new employees / users – nobody wants to sit and create **multiple user accounts** on the first day of work.
 

### How does Provisioning work? {#how-does-provisioning-work}
Now that we’ve understood that user provisioning is a simple but necessary identity management automation process that takes care of individual digital identities along with their access rights, permissions, and data changes for a business, let’s take a look at how it works.  

When we look at an automated user provisioning information flow for a business, we see that users are added to applications and services based on specific, predefined user roles for security purposes. Whenever a user is assigned a role, that user is automatically created in the associated application/service and granted required access permissions.  

Consequently, when any user is “deprovisioned”, that user’s identity, assets and all of its related accounts across the organization’s applications/services ecosystem are deleted without needing manual intervention. All granted permissions and authorizations are securely revoked, as a result.  

Example –

![User Lifecycle Management | Automated Provisioning](/blog/assets/2023/user-lifecycle-management.webp)
 

 

### What are the different variations of Provisioning? {#what-are-the-different-variations-of-provisioning}
As with most IT processes, provisioning comes in various shapes and forms. Not all of these are categorically different from one another, some are subsets or supersets of each other, but let’s briefly look at what these mean –  

1. **User Provisioning** can be defined as the broad process which involves all of the individual sub functionalities, namely account creation – deletion – updation, permissions and access management, data modification, identity storage and handling, etc.
2. **Group Provisioning** involves a simpler way of dealing with individual users and provisioning processes of those users –  by identifying identities under groups and then handling the process for those groups as a whole. It can be understood as further optimization of the automation that is provisioning.
3. **[SCIM Provisioning](https://www.miniorange.com/products/scim-provisioning-gateway)** is an abbreviation for “System for Cross-Domain Identity Management”. SCIM is, simply put, an open standard that communicates user identity data between Identity Providers and Service Providers.
4. **Account Provisioning** involves all the processes that act on user accounts, which includes account creation, deletion, changing, permission management, securing data, disabling, etc.
3. **Identity Synchronization** refers to a secure real-time and automatic syncing of data across different identity stores (cloud or on-premise) that are connected. An example of this would be – changing of source e-mail address should change the email address everywhere it is used.
 

### Automated Provisioning & Deprovisioning {#automated-provisioning-and-deprovisioning}
The automated provisioning means adding, updating, and deleting users, and managing user access in a network. In addition to eliminating the challenges and delays of manually managing profiles and account rights, it reduces human mistakes, improves operational efficiency, data privacy and eliminates network and other security breaches.  

In the same way that [Automated Provisioning](https://www.miniorange.com/blog/automated-user-provisioning/) can enable users to deploy and activate services, it can also disable their access to data, systems, and applications. This is known as Automated Deprovisioning.

 

### Benefits of Automated Provisioning {#benefits-of-automated-provisioning}

**Streamlined onboarding:**  
By automating provisioning, you can take the user onboarding burden off of HR or IT departments. Through this process, organizations can provide their new employees, contractors, consultants, etc. with access to specific applications (cloud or on-premise), network, data and resources they need to perform their jobs.  

**Increased Productivity:**  
This improves productivity by giving them access to the cloud services they need from day one. Users are empowered to start working immediately without having to wait for access.  

**Cost savings:**  
When you reduce the amount of time and resources spent on manual provisioning, you can focus on other tasks. You also eliminate user downtime when they don’t have access to what they need, resulting in more productivity, lower operational expenses, and improved operational efficiency.   

**Error reduction:**  
It eliminates manual operations, the margin of error is considerably reduced. When adding a user to the system and providing access to programs, there’s less of a possibility of making a mistake.  

**Security:**  
Furthermore, automating reduces the risk of security risks, network or data breaches because access to these cloud applications is only granted through the roles and permissions established by the business.  

**Get deeper insights & analysis:**  
Optimization of the network based on a detailed overview of the data, network and policy-based network setup. This is in contrast to the current practice of making ad hoc operational decisions based on a fragmented view of the network.

 

### Provisioning with miniOrange {#provisioning-with-miniorange}
With miniOrange and our wide range of User Provisioning solutions, you can create, manage, & delete your external and internal users’ access to on-premises, cloud, and hybrid apps.  

We also have pre-integrated apps for Provisioning and Deprovisioning:  

- [Azure/Active Directory](https://www.miniorange.com/azure-ad-provisioning)
- [G-Suite App](https://www.miniorange.com/google-workspace-provisioning)
- [Microsoft 365](https://www.miniorange.com/office-365-provisioning)
- [Salesforce](https://www.miniorange.com/salesforce-provisioning)
 

![Pre-Integrated Apps for Provisioning that miniOrange supports](/blog/assets/2023/automated-provisioning-apps.webp)


Linked is an overview of our [Provisioning solutions](https://www.miniorange.com/user-provisioning) as well as in-depth steps to implement the solution. miniOrange can set up a complete automation for User Provisioning in your organization in no time! We have both cloud and on premise solutions available based on the organization’s requirements.  

Check out all of our pre-existing Provisioning integrated apps [here](https://www.miniorange.com/iam/integrations/?id=provisioning).  

&nbsp;  

&nbsp;  

#### **Further Reading:**  

- [Passwordless Authentication](https://www.miniorange.com/iam/solutions/passwordless-authentication/)
- [Adaptive Authentication](https://www.miniorange.com/adaptive-multi-factor-authentication-mfa)
- [What is Customer Identity and Access Management (CIAM)?](https://www.miniorange.com/blog/what-is-ciam-customer-identity-and-access-management/)

Provisioning manages access of all identities across all connected IT Infrastructure in business for apps, servers and data. Provisioning means providing.

What is Provisioning and how does it work?


According to Security Magazine, the typical business user oversees 191 passwords for work-related purposes and dozens more for personal ones. Up to 5 million passwords may be used by staff members of a company with 25,000 employees. Given the prevalence of passwords, password vulnerabilities are a major contributor to security breaches that result from cyber-attacks.  
Passwords that are too simple, easily figurable, used on multiple systems, and not frequently enough present hazards. Avoiding using the same password across many systems is one of the finest security measures. The majority of experts are familiar with this principle. However, 61 percent of typical corporate users acknowledge using the same password across the board.  
Employees waste a lot of time inputting passwords, which is another issue with this password bloat. Eliminating the need for multiple passwords is one approach to the password management issue. It is feasible to use a centralized authentication technique provided by a “web-based single sign-on” (Web SSO) system in place of using a collection of passwords to access various online services.


### What is Web SSO? {# What is Web SSO?}
Web SSO is a technique for managing browser-based sessions that keeps the user logged in across all of your applications by using sessionStorage, localStorage, and cookies. On-demand authentication is provided by a centralized domain, which also shares the session with authorized applications. Therefore, regardless of the platform or domain, the user is utilizing, once a customer logs in to any one application, they can instantly log into another.


### How does web single sign-on work? {# How does web single sign-on work?}
A trust connection between online systems and websites is necessary for a web single sign-on system. When a user accesses an online service or a website that requires a password, web SSO systems follow these steps for authentication:  

**Verify Sign-In:** Checking to determine if the user is already logged into the central authentication system is the first step. Access is immediately given if the user is logged in. If not, the user is told to sign in.  

**User Sign-In:** The user must first sign into the authentication system with a special username and password before beginning any session. The session token used by the authentication system is valid until the user logs out.  

**Confirmation of Authentication:** Following the completion of the authentication procedure, the authentication data is sent to the web service or website requesting user verification.


### Web App SSO: Is It Still In Use? {# Web App SSO: Is It Still In Use?}
The market is moving away from providing this as a more conventional point solution in conjunction with a separate directory service, even if the web application SSO is still widely used across many enterprises.  

Alternatively, the interest and adoption of broader, more comprehensive identity and access management (IAM) platforms are expanding, with the web app SSO as a major component.
Among many other features that allow IT more control over identities and access, a comprehensive IAM platform has extensive single sign-on capabilities.  

Organizations no longer need to worry about adding a web application SSO solution on top of their own directory/IdP because all essential IAM functionalities are available in a single platform.  

The transition away from web app SSO point solutions is happening for a few reasons:

- An interest in vendor consolidation.
- A desire to avoid hidden costs.
- A widespread need for improved identity and access management.
 
 
### Common Web App SSO Use Cases {# Common Web App SSO Use Cases}
There are a variety of use cases that drive web app SSO adoption:

1. Small organizations that use a variety of web applications.
2. Mid-market and enterprise-sized organizations that implemented web app SSO back when it was more relevant as a standalone solution within the IT environment.
3. Organizations with Active Directory (AD) in place already.
4. Organizations trying to adopt an IAM strategy.
5. Organizations that are unaware of the modern cloud-based replacement for AD and web app SSO that is a far more seamless, cost-effective, and integrated platform.
 

### Password vaulting vs. Web SSO {# Password vaulting vs. Web SSO}
A secured vault containing several passwords for various online services is different from a web SSO. By using a single username and password, password vaulting secures numerous passwords. However, each time a user visits a new online service this necessitates a signing into the service. There must still be a sign-in process even if the form fields are automatically filled out using information from the password vault. Once a person has been authenticated via Web SSO, they are no longer required to sign in to any web services that make use of that authentication method. This is called a “sign in once/use all” authentication approach.
 

### Why Web SSO Is Necessary for Your Business {# Why Web SSO Is Necessary for Your Business}
By securely collecting a plethora of customer data and credentials in one location for usage by your services, teams, and applications, single sign-on immediately helps your organization. Customers will view you negatively as they attempt to use your apps and services if you don’t use SSO. The numerous advantages that single sign-on offers your company, on the other hand, make product managers who implement an SSO solution stand out:

1. **Boosts IT staff members’ productivity**  
In general, a single point of access reduces the number of time users must spend resolving password-related problems and concerns. Single sign-on allows you to:  

**Reduce support calls:** Users who only need one password to access all of their apps won’t need it as frequently.  

**Enhancing the consumer experience:** Customers minimize the time between 10 and 15 seconds on each sign-in since there is no need to go between numerous login URLs or change passwords.  

**Reduce security risks:** Employees can use SSO capabilities to log in with a single set of credentials on any device and in any web browser without jeopardizing security.  

As we can see, one of the most important advantages of single Sign-On is the capacity to improve consumer productivity.

2. **Strengthened security capabilities**  
There are certain myths surrounding the deployment of the SSO solution, such as the idea that it reduces security because if the master password is stolen, all connected accounts will be at risk. This seems to be the case in theory, but by using SSO and common-sense procedures, we can lessen password theft. Customers are more likely to construct a stronger (harder to guess) passphrase and reduce risk by limiting bad password practices since they only need to remember one password for various applications.

3. **Integrates SSO with Risk-Based Authentication (RBA)**  
As was already noted, SSO provides your customer with a single “key” that allows them to sign in to various online pages, mobile apps, and third-party systems with a single identity. Combining SSO with risk-based authentication (RBA), which allows businesses and their security team to track consumer behavior, would increase security even further.  
In this manner, a company can request additional identity verification if it notices any strange customer activity, such as the use of an incorrect IP address or repeated login failures; if the customer fails at this stage, the company can ban or suspend their access to the account. Organizations may protect their websites and apps against assaults by utilizing this powerful combo. They can feel secure knowing that data thieves and IT hogs won’t take their information.

4. **Makes the consumer experience more efficient**  
Customers can enjoy a cutting-edge digital experience since SSO eliminates the need for multiple logins. Customer happiness, a boost in loyalty, and improved conversion rates are advantages for businesses.

 

### Conclusion {# Conclusion}
In this post, we discussed Web Single-Sign-ON capability and potential to increase company ROI. We discovered how it improves responsiveness, security, comfort, and efficiency for both customers and businesses. Web SSO is incredibly practical and popular.  

Get a Demo and Try miniOrange’s SSO Solution for Free.
Explore miniOrange’s modern IAM SSO solution and see if it helps out to streamline your Organizational process in addition to security. Create a miniOrange Free Account and get access to all features for free, for up to 30 Days with 24*7 free support to help you out with the setup.



A web SSO system allows a user to access many other web apps and password-protected websites with a single set of credentials for authentication.

Web SSO: What is it and How does it Work?


### What is External API in WordPress? {#what-is-external-api-in-wordpress}


External APIs are designed in such a way that they can be used within an organization or by any person outside the organization who wants the interface access. These External APIs are accessible to External, Third-Party Partners. If a person wants to access these APIs they will require API Keys and security Tokens. When it comes to using External APIs in WordPress the most basic functionality is in which we need to fetch data from an external, third-party API provider and use this data to display on the WordPress website and process it further. This can be easily done by using our [Custom API for WordPress](https://plugins.miniorange.com/custom-api-for-wordpress) plugin in which hooks are provided, using which calls to External APIs can be made whenever required. these hooks can be integrated easily with the third-party plugins in WordPress like – Woocommerce, Wpforms, Gravity forms, Fluent forms, Elementor, Payment gateways, etc.


![external-api-integration](/blog/assets/2023/external-api-integration.webp)

### Multiple ways by which you can Integrate External APIs into your WordPress Website. {#integrate-external-apis-into-your-wordpress-website}

**1. Directly Fetch data from a REST API endpoint provided by a third-party/external provider**

![external-provider](/blog/assets/2023/external-provider.webp)

To Directly fetch the data from an external API provider, you need to have a REST API Endpoint which will be provided by the third-party provider. Here a direct API call is made to the external API endpoint and if the request is validated then you get the required data in form of a response. Once this data is fetched, it can be used to display on your WordPress website. This is one of the easiest ways to fetch your data from a third-party application into WordPress using External APIs.


**2. Use External APIs to perform form submission events**
![submission-external-api](/blog/assets/2023/submission-external-api.webp)

Using External APIs in WordPress is useful when you want to perform certain operations like Register, SignIn, Delete users in WordPress and these changes must reflect in the third-party application/platform. These operations are possible by making an external API call to the third-party provider once an event is triggered or a form is submitted in WordPress. Events can be triggered when a form is submitted in WPforms, Gravity Forms, Elementor, Contact-form7 or any other forms.


**3. Integrate External REST APIs on Payment gateways**
![payment-gateway-apis](/blog/assets/2023/payment-gateway-apis.webp)

External APIs in WordPress can also be used to trigger API calls when a payment is captured by Third-Party payment gateways like PayPal, Stripe, Woocommerce etc. By using these API calls it is possible to update the user status, user’s membership level etc on the WordPress or third-party API provider based on the payment status and amount.


**4. Directly fetch and update product data in WooCommerce from a third-party inventory store in real-time**
![inventory-store-apis](/blog/assets/2023/inventory-store-apis.webp)

Using External APIs in your WordPress website you can easily fetch real-time data from an external, third-party API provider into Woocommerce to display data or products, External APIs can be called in the backend using the developer hooks to sync the real-time data with Woocommerce products/items feeds and can be displayed on your site.


### Benefits of using External APIs with payment gateways in WordPress: {#benefits-of-using-external-apis-with-payment-in-wordpress}

- It becomes possible for your customers to Directly pay and make transactions on your WordPress website itself. This means that your payment is just an API call away.

- It becomes possible for you to accept payments from multiple payment gateways like PayPal or Stripe. This is important because most customers prefer their personal choice of payment method and will appreciate it if they see one. So, once you have the payment status as completed, then you can update user’s data on the WordPress/third-party side like user membership levels, permission levels etc.


- API which these payment gateways provide flexibility to handle all types of transactions while still providing the security and resilience that your CFO business needs.


In miniOrange’s WP Custom REST API Plugin hook is provided for this external REST API endpoints integration and this hook can be embedded directly into the gateways and run only based on the transaction status.


### Try Out Our miniOrange Custom API Plugin for WordPress? {#miniorange-custom-api-plugin-for-wordpress}
![miniorange-custom-api](/blog/assets/2023/miniorange-custom-api.webp)

The best way to see how External APIs work with your WP website is to try it out yourself.

## Key Plugin Features:

## Unlimited External API Connections

Unlimited external APIs(endpoints) connections can be created using easy to use User Interface and then with the use of developer hooks, these connections can be connected to the backend to execute the corresponding external API.

## Support for HTTP Methods (GET, POST, PUT, DELETE)

The plugin supports all the external APIs which supports GET, POST, PUT, DELETE and accepts data in application/JSON or x-www-form-urlencoded.

## Compatibility with third-party plugins in WordPress.

The plugin provides a developer hook to execute external API from WordPress backend and this developer hook is compatible with the third-party plugin as well like Woocommerce, WPforms, gravity forms, payment gateway plugins, membership plugins etc. and hence can be integrated with any events of these plugins.


You can simply download our [Custom API for WordPress](https://wordpress.org/plugins/custom-api-for-wp/) plugin in WordPress, after activation of our plugin you can follow Our [Step-By-Step Guide to Configure Custom REST API.](https://plugins.miniorange.com/keycloak-single-sign-on-wordpress-sso-saml)


Contact us at oauthsupport@xecurify.com and we’ll help you set up the Custom API plugin in no time.


## Conclusion

Using External API’s in WordPress makes fetching data into your WordPress website from a Third-party API provider a very easy task. Using hooks provided in the Custom API for WordPress Plugin you can make calls to External APIs whenever required. These hooks can be integrated easily with the third-party plugins in WordPress like – Woocommerce, Wpforms, Gravity forms, Fluent forms, Elementor, Payment gateways etc.

## Further Reading

- [Integrate External REST API into WordPress | Custom Rest API](https://plugins.miniorange.com/integrate-external-third-party-rest-api-endpoints-into-wordpress)
- [Custom REST API for WordPress | WordPress Custom REST API](https://plugins.miniorange.com/custom-api-for-wordpress)
- [Custom API For WP – WordPress plugin](https://wordpress.org/plugins/custom-api-for-wp/)
- [WordPress REST API Authentication | WordPress Plugin](https://plugins.miniorange.com/wordpress-rest-api-authentication)

What is External API for WordPress And How To Get Started Using It?