Skip to content
Craftifact

Identity provider for Craftifact instances

How authentication for your Craftifact instance relates to the Control Plane login and when to use the managed or custom IdP path.

Two separate login scopes

Craftifact deliberately separates management access from repository access:

  • the account you use to purchase your subscription also manages your running instances in the Control Plane
  • the login for your Craftifact instance gets you into the repository itself

These are not the same identity just because the same email address is used in both places.

Managed SoluForge IdP

If you keep “Use iam.soluforge.de as IdP”, SoluForge manages the OIDC setup for the instance.

What that means in practice:

  • the first managed instance creates an admin user in a dedicated realm for your instance
  • later instances can reuse the same managed realm
  • changing the instance name updates the managed realm display name
  • changing the instance domain updates the managed client redirect URLs
Rationale: why the realm is separate from the Control Plane
The control plane and the deployed repository solve different problems. Keeping them in separate realms avoids confusing shared state and makes the management boundary explicit.

Custom OIDC

If the instance should use your own identity provider, provide:

  • client_id
  • client_secret
  • issuer_url
  • groups_claim
  • groups_scope if your provider requires one

Do not store client_secret in plain text in config. Put it into the Secrets tab and reference it via ${...}.

Current details:

  • groups_scope is optional
  • leaving client_secret empty on update keeps the stored secret
  • you can configure custom OIDC during instance creation or later in the Identity Provider tab

Practical guidance

  • Use the managed SoluForge IdP for the shortest onboarding path.
  • Use custom OIDC when the instance should rely on your existing corporate identities and group claims.
  • When you switch approaches later, treat it as a real auth change and verify redirect URLs, claims, and group mapping before handing the instance to a wider team.