FoxIDs Control

FoxIDs is configured through FoxIDs Control, which consists of Control Client and Control API. Control Client and Control API are secured by FoxIDs, and Control Client uses Control API.

Control API contains all the configuration functionality. Therefore, it is possible to automate the configuration by integrating with Control API.

FoxIDs Control Client

Control Client is a Blazor WebAssembly (WASM) app.

Open your Control Client on FoxIDs.com.

Tenant and master environment

If you use FoxIDs.com, your tenant is created during registration.

If you deploy FoxIDs (self-hosted) you get access to the master tenant. First create a tenant to contain your security configuration. Most installations only need one, but you can configure an unlimited number of tenants.

Configure tenants

A tenant contains a master environment, from where the entire tenant is configured. The master environment contains a user repository and on creation only one administrator user.

Normally you should not change the master environment configuration or add new authentication methods or application registrations, but it is possible. You can e.g., by adding an authentication method gain single sign-on (SSO) to the master environment.

Create administrator user(s)

It is possible to create more administrator users in the master environment. A user becomes an administrator by adding the administrator role foxids:tenant.admin like shown below.

Create a user:

  1. Open the master environment
  2. Select the Users tab
  3. Click Create User
  4. Add the user information and click Create.

Configure administrator user

Grant access to user

Access is granted with roles. Scopes are only needed when a client requests a token for Control API; Control Client already requests the required scope on foxids_control_api, so you typically only assign roles to the user in the master environment.

To let a person sign in to Control Client and see configuration data:

  1. Create or open the user in the master environment (Users tab).
  2. Add the baseline role foxids:tenant:basic.read (required for Control Client to load profile and helper tools).
  3. Decide what the user is allowed to see:
    • To limit visibility to one environment, add foxids:tenant:track[vh2csjt4].read (replace vh2csjt4 with the technical environment name).
    • To allow all environments, add foxids:tenant.read.
  4. Add the operation roles the user needs in each environment. Examples: foxids:tenant:track[vh2csjt4]:user to manage users, foxids:tenant:track[vh2csjt4]:party to manage applications and authentication methods.

Control Client vs API-only:

  • Control Client (interactive UI) reads profile data and environment lists in addition to the specific API you want to manage. It therefore needs foxids:tenant:basic.read plus an environment read role (foxids:tenant:track[main].read or foxids:tenant.read) alongside your action roles.
  • API-only callers can be narrower. If a backend service only calls the user API for the vh2csjt4 environment, role foxids:tenant:track[vh2csjt4]:user (and requesting the matching scope when using client credentials) is sufficient; the extra read roles are not required because no UI data needs to be loaded.

Environments

An environment is an independent Identity Provider with its own user repository, certificate, authentication methods, application registrations, and settings. Use separate environments to isolate stages such as development, test, and production.

See Environments for environment separation, contents, creation, and configuration.

FoxIDs Control API

Control API exposes FoxIDs configuration and administration as a secured REST API. Control Client uses the same API, so configuration tasks can also be automated by your own services and deployment tooling.

Start with the Control API guide to configure authentication, construct endpoint URLs, choose scopes and roles, and find the resource-specific guides.

Self-hosted deployments expose the OpenAPI document at .../api/swagger/v2/swagger.json and Swagger UI at .../api/swagger.

API access rights

See Control API access rights for the scope and role model and the complete access-right tables.