Lastwall

Preview

This integration is in preview.

Prerequisites

Complete the preparation checklist.

Application setup

In the IDCommand Admin Portal, create an OIDC application with type Confidential, Authorization Code, and Client Secret Basic (or Client Secret Post when required). Enable Require PKCE and disable Accept Plain Code Challenges. Set the callback to https://api.<platform-host>/identity/callback and select the installation's authentication policy. Register https://<platform-host> and any other approved frontend addresses as logout return URLs according to the deployment's requirements.

Use your Istari domain for <platform-host>. For a custom API hostname or base URL, use the configured callback address.

Collected values

Collect the application's client ID, secret, and exact issuer. Confirm the issuer path, commonly /idp; the host root is not interchangeable with it. Check <issuer>/.well-known/openid-configuration returns that exact issuer and HTTPS authorization, token, and JWKS endpoints. Check whether UserInfo and logout endpoints are advertised before relying on those features. Use discovered endpoints rather than copying paths from another deployment.

Installation configuration

istari-values.yaml (excerpt)

identity:
  oidc:
    provider: lastwall
    issuer: "https://<lastwall-host>/idp"
    clientId: "<client-id>"
    clientAuthMethod: client_secret_basic
    scopes: "openid profile email"
  idpMigration:
    enabled: false

Store ISTARI_DIGITAL_IDENTITY_SERVICE_OIDC_CLIENT_SECRET in the Identity Service Secret. Set ISTARI_DIGITAL_IDENTITY_SERVICE_ENROLLMENT_POLICY=pre-registered-only.

Account preparation

Import authoritative sub mappings before login and set identity.idpMigration.enabled: false. For a new person, use import-humans -provider lastwall with upstream_subject; for an existing person, link the old subject with new_provider=lastwall. Lastwall never claims email-only registrations, even if the provider returns email_verified or the deployment uses open enrollment. Istari memberships select the tenant; Lastwall groups and claims do not.

See account import commands and administrator setup.

Verification

Confirm the original principal, tenant membership, and roles survive the switch. Test logout before and after upstream expiry, including Lastwall's SSO-session outcome and the return URL. Check ownership, editing, and sharing separately from login.

Limitations

Use openid profile email. The inspected provider metadata advertised neither offline_access nor upstream refresh tokens. Istari rotates its own refresh tokens and may renew the local session after upstream access expires, until local expiry or the absolute session ceiling. When upstream refresh is unavailable, renewal does not establish that the upstream account is still active. Set session duration accordingly and verify the target deployment's policy.

Preview validation has identified issues with Registry tenant bindings, profile names, and frontend permissions. Verify these workflows, including editing and cross-user sharing, before rollout.