Identity providers
The Identity Service connects to one identity provider per installation. Use Istari Platform chart 7.1.0 or later for all seven providers below.
Start with the preparation checklist, then follow your provider's setup guide. Okta, Google, and Lastwall are in preview.
Provider capabilities
All providers use Authorization Code with PKCE. Authentication below refers to the application's token exchange.
| Provider | Client authentication | Account preparation | Refresh and logout |
|---|---|---|---|
| Zitadel | Private-key JWT or client secret | Organization import | Upstream refresh and logout |
| Microsoft Entra ID | Client secret | Immutable Object ID (oid); Istari memberships | Upstream refresh and logout |
| Google (Preview) | Client secret | Immutable sub; restricted Workspace email linking | Offline grant; local logout only |
| Keycloak | Private-key JWT or client secret | Prepared verified email or subject; grouping mappings | Upstream refresh and logout |
| Lastwall (Preview) | Client secret | Immutable sub; no email enrollment | Local refresh; verify upstream refresh and logout support |
| Okta (Preview) | Client secret | Prepared subject or trusted verified email | Upstream refresh and logout |
| PingFederate | client_secret_basic | Prepared subject or trusted verified email | Upstream refresh and logout |
For Entra, Google, Lastwall, Okta, and PingFederate, Istari memberships determine tenant access. Provider groups and tenant claims do not grant membership. Provider-specific setup and limitations are on each guide.
Upstream refresh requires a refresh grant from the provider; upstream logout requires a discovered or explicitly configured end-session endpoint.
New installation
Choose a provider from the table above and follow its setup guide, then install Identity Service with the provisioner. For a provider other than Zitadel, keep identity.idpMigration.enabled: false as shown in its guide.
Selecting another sign-in provider does not remove all platform dependencies on Zitadel. Keep the Zitadel configuration in the platform Secrets: legacy user-management operations and the documented Secure Connection Service setup still use Zitadel.
Create tenants and user accounts, then appoint the first platform administrator before users sign in. No provider migration is needed.
Installation That Keeps Zitadel
Use the Zitadel setup guide, then verify the recurring organization import.
Installation That Moves from Zitadel
Follow Switching from Zitadel to prepare accounts and preserve their tenant memberships and resource access.