How to map users from external identity providers to newly created local or domain users

How to map users from external identity providers to newly created local or domain users

Introduction

In Thinfinity Workspace, you can effectively manage system access across various authentication providers with its ‘Create if it doesn’t exist’ feature, enabling seamless mapping of users from external identity providers to local or domain users on the host machine, even when these users are not preexisting in the host environment.

This powerful feature empowers administrators to create local or domain users on the host machine while connecting to external Identity Provider technologies, such as Radius, OAuth (Google, LinkedIn Facebook, Azure AD, Okta, Duo), SAML and others.

The Create if it doesn’t exist function ensures that when a verified user from an external domain logs in, Thinfinity Workspace captures their external ID and automatically generates a corresponding local account on the host machine, complete with pre-established permissions as defined by the administrator.

How to Map External users and create a user locally.


You can make a certain Profile create the users on demand if they do not exist once a certain external authenticated user is trying to access that application.

To map external users from various domains to local accounts on the host machine using Thinfinity Workspace, follow these steps: 

  1. Open Thinfinity Workspace Configuration Manager on your primary broker.

  2. Go to the ‘Access Profiles’ tab and locate the profile you want to modify.

  3. Click ‘Edit’ to modify its settings.




  1. In the ‘General’ tab, select the ‘Use these credentials’ option and then check the box ‘Create if it doesn’t exist’


  1. Complete the Pattern and Replace fields with the correct Regular Expression for you:


Example of user creation against external domains that use @contoso.com as method of user authentication (works for Azure as well):


Pattern: ([a-zA-Z0-9\.]+)@contoso\.com\$

Replace with: targetdomain\\$1


Example of user creation against external domains that authenticate with the domain (Ex. contoso\) as method of user authentication:

Pattern: ((?i)contoso)\\(.+)

Replace with: targetdomain\\$2




If you want the newly created user to have the same permissions assigned as a specific pre-configured group within your local/domain environment, you can use the ‘Add to group’ field.


Note that you can also configure this from Thinfinity Workspace web page using the same set of options, whether it’s for a new or an existing profile:





Summary

In summary, Thinfinity® Workspace‘s Create if it doesn’t exist feature enables seamless mapping of external users to local accounts on the host machine, even when they are not preexisting in the host environment. This feature offers a secure and efficient way for administrators to manage system access across various authentication providers and improve remote access experiences. This concludes the Tutorial to Map Users from External domains to newly created Local Accounts on Demand.