Skip to main content

OIDC and SCIM Identity Integration with ZTXGate

ZTXGate can use an organization's existing identity provider instead of creating another isolated user lifecycle.

Two standards play different roles:

OIDC  → authentication and identity claims
SCIM  → provisioning and identity lifecycle

OIDC for Authentication​

OpenID Connect allows users to authenticate through a compatible identity provider and lets ZTXGate receive the identity information required for access decisions.

Authentication establishes who the user is. ZTXGate policy then determines which resources that identity may reach and under what conditions.

SCIM for Provisioning and Lifecycle​

SCIM can synchronize users and lifecycle changes so access administration follows organizational identity changes more closely.

Where appropriate, directory groups can be mapped into ZTXGate roles, reducing the need to duplicate user administration manually inside the access platform.

Identity Is One Policy Signal​

A successful identity-provider login does not grant broad network access by itself.

ZTXGate can evaluate identity together with:

  • enrolled device identity
  • MDM or EDR posture
  • resource definition
  • network location and time
  • temporary or approved access windows
  • additional authentication requirements

This keeps authentication separate from authorization.

Connected and Air-Gapped Identity Models​

An external cloud identity provider requires connectivity to that provider. Fully air-gapped deployments can instead operate without a mandatory CoreZT cloud control plane and use locally available identity and authentication options according to the deployment design.

When licensed, integrated ZTXBAS can provide phishing-resistant biometric authentication inside an air-gapped ZTXGate deployment without an internet-hosted push service.

Okta and Other Compatible Providers​

ZTXGate supports standards-based identity integration and has additional capabilities for Okta, including supported step-up authentication and SSF/CAEP security-event signaling.

Explore all integrations · Identity & Device Trust · Security & Trust · Start Free Trial