Sign-in: internal accounts, Google and other providers

Pick a way in

Colleagues sign in once, at the portal, and every app trusts that sign-in. You need at least one way in, and you can turn on several:

• Internal accounts: invite-only, with a password and an authenticator app. Nothing to set up elsewhere.
• Google Workspace: colleagues use their Google account. Needs an OAuth client in Google Cloud.
• Microsoft Entra ID, Smartschool or any OpenID Connect or OAuth2 provider.

Administrators is the one field you always fill in: the addresses that become administrator. With Google they are administrator from their first sign-in; with internal accounts they get an invite link.

Internal accounts

In the portal: Setup wizard, step 2, or Admin, Settings, Sign-in and access

Turn on Internal accounts. People get in only by invitation, choose a password, and must enrol an authenticator app (any TOTP app: Google Authenticator, Microsoft Authenticator, 1Password, …) before their first session.

The password rules (minimum length, capital, digit, symbol, not containing the email name) appear once internal accounts are on. Somebody whose password no longer meets new rules is asked to choose a new one at their next sign-in.

Locked out? As root on the server:

cyantula reset-admin you@example.com

Google Workspace

In the portal: Setup wizard, step 2, or Admin, Sign-in providers, Google Workspace

You need a Google Cloud project, made with your Workspace account.

1. Open Google Auth Platform in the Google Cloud console and pick or create a project. Set the audience to Internal, so only accounts in your Workspace can use it.
2. Go to Clients and click Create client. Application type: Web application.
3. Under Authorised redirect URIs, add the address the portal shows you, which is https://<your portal>/auth/callback.
4. Create it and copy the Client ID (ending in .apps.googleusercontent.com) and the Client secret into cyantula.
5. Fill in Google Workspace domains that may sign in, for example example.com. Left empty, nobody gets in through Google: cyantula refuses rather than letting everyone in.

Microsoft Entra ID (Microsoft 365)

In the portal: Admin, Sign-in providers, Add provider, Microsoft Entra ID

1. In the Microsoft Entra admin center, go to App registrations and click New registration. Supported account types: this organisational directory only.
2. Redirect URI: platform Web, with the redirect address cyantula shows after you save the provider. You can add it later under Authentication.
3. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID.
4. Under Certificates & secrets, add a client secret and copy its Value (not its ID). Note when it expires: sign-in stops working that day until you paste a new one.
5. In cyantula, the issuer is https://login.microsoftonline.com/<tenant ID>/v2.0. Use your own tenant, never the shared common address. Fill in the e-mail domains this provider may sign in.
6. Want Microsoft groups to give roles? Under Token configuration, click Add groups claim and pick Security groups (or Groups assigned to the application). Then choose which groups count under Groups and roles in the provider's menu in cyantula.

Smartschool

In the portal: Admin, Sign-in providers, Add provider, Smartschool

1. Ask the Smartschool administrator of your school to register an OAuth client on the school's own Smartschool address. See Smartschool's OAuth documentation.
2. Give them the redirect address cyantula shows after you save the provider.
3. Fill in the authorization, token and userinfo addresses on your school's own Smartschool domain, plus the client ID and secret they give you.
4. Click Test sign-in once to check the claim names against what your school sends. Classes as groups: add groupinfo to the scopes and follow the hint under Groups claim.

Any other OpenID Connect or OAuth2 provider

In the portal: Admin, Sign-in providers, Add provider, Other OpenID Connect (or Other OAuth2)

Keycloak, Authentik, Okta, Google Cloud Identity or anything else. Register a confidential web client at the provider with the redirect address cyantula shows, then fill in:

• Issuer for OpenID Connect, then click Check issuer. For plain OAuth2: the authorization, token and userinfo addresses from the provider's documentation.
• Client id and Client secret.
• E-mail domains it signs in: only addresses on these domains get in through this provider.
• Optional: a Groups claim to keep groups in step, and the claim names when the provider uses unusual ones.

Share links

In the portal: Admin, Settings, Sign-in and access

Allow external share links lets an owner give somebody without a company account an expiring link to one app. Turning it off revokes every link already handed out. The default and longest expiry, and the number of links per app, are under Advanced.

Apps that hold sensitive personal data

In the portal: Admin, Settings, Sign-in and access; the list is under Admin, Insights and audit, Sensitive data

cyantula notices apps that hold sensitive personal data. Admin, Insights and audit, Sensitive data lists them, high risk first, with the owner, how many people and groups may open each one, and whether anything is open to outsiders.

Sensitive apps open to outsiders only by an admin means an owner can no longer give a high risk app public pages, make it a public app or create an external share link: an admin does it. Doors that are already open stay open, and closing one is always allowed. Turn the setting off to leave that choice with the owner.