Identity & Access

BlueWhale Stack's Identity & Access module federates your existing identity provider (IdP) via SAML 2.0 or OIDC, eliminating the need for local accounts. Users log in with their existing corporate credentials, and their platform roles are automatically provisioned and de-provisioned based on IdP group membership.

Federation with Entra ID uses SAML 2.0. Users are authenticated by Entra and their group memberships are used to assign BlueWhale roles.

1. 1

   Create an Enterprise Application

   In the Azure portal, go to Entra ID → Enterprise applications → New application → Create your own application. Name it BlueWhale Stack and select Integrate any other application you don't find in the gallery.

2. 2

   Configure SAML

   Under Single sign-on → SAML, enter the Identifier (Entity ID) and Reply URL (ACS URL) shown in BlueWhale Stack → Settings → Identity → Add IdP → Entra ID.

   # Values to copy from BlueWhale Stack:
   Identifier (Entity ID): https://enterprise.bluewhalestack.com/saml/<ORG_ID>
   Reply URL (ACS):        https://enterprise.bluewhalestack.com/saml/<ORG_ID>/acs

3. 3

   Map group claims

   Under Attributes & Claims, add a group claim that sends the Entra group names (or Object IDs). In BlueWhale Stack, map each group to a platform role (Owner, Admin, Editor, or Viewer).

4. 4

   Download the SAML metadata

   Download the Federation Metadata XML from the SAML Signing Certificate section and upload it to BlueWhale Stack to complete the setup.

Okta federation uses OIDC (preferred) or SAML 2.0. OIDC is recommended as it enables token refresh without re-authentication.

1. 1

   Create an Okta application

   In the Okta Admin Console, go to Applications → Create App Integration → OIDC - Web Application.

2. 2

   Set the redirect URI

   Add the BlueWhale Stack callback URL as the Sign-in redirect URI.

   Sign-in redirect URI:
   https://enterprise.bluewhalestack.com/auth/callback/okta

3. 3

   Copy OIDC credentials

   Note the Client ID and Client Secret. In Okta → Security → API → Authorisation Servers, note your Issuer URL (e.g., https://your-org.okta.com).

4. 4

   Enter in BlueWhale Stack

   In Settings → Identity → Add IdP → Okta, enter the Issuer URL, Client ID, and Client Secret. Map Okta groups to BlueWhale roles.

AWS Identity Center (formerly AWS SSO) can act as a SAML identity provider for BlueWhale Stack. This is useful when your organisation already uses AWS Identity Center to manage access across AWS accounts.

1. 1

   Add a custom SAML 2.0 application

   In AWS Identity Center → Applications → Add application → Add custom SAML 2.0 application.

2. 2

   Configure SAML metadata

   Under Application metadata, enter the ACS URL and Entity ID from BlueWhale Stack → Settings → Identity → AWS Identity Center.

3. 3

   Assign groups

   Under Assign users and groups, add the Identity Center groups that should have access to BlueWhale Stack.

4. 4

   Map attribute claims

   Add an attribute mapping for groups: map the Identity Center memberOf attribute to the BlueWhale groups claim. Download the SAML metadata and upload to BlueWhale Stack.

BlueWhale Stack ships with four built-in roles that cover most teams. Custom roles are available on Enterprise edition.

• Owner — full platform access including billing, connectors, and user management
• Admin — all module access except billing and connector credential management
• Editor — can view and act on resources, raise ITSM tickets, and use Whale AI; cannot change settings
• Viewer — read-only access across all modules; cannot take lifecycle actions

On Enterprise edition, custom roles can be created with granular module-level permissions. For example, you can create a FinOps Analyst role that can read cost data and run reports but cannot take any lifecycle actions.

Enable SCIM 2.0 to keep your BlueWhale Stack user base in sync with your IdP automatically. When a user is added to an IdP group mapped to a BlueWhale role, their account is provisioned immediately. When they are removed, their access is revoked — no manual intervention needed.

1. 1

   Generate a SCIM token

   Settings → Identity → SCIM provisioning → Generate token. Copy the token — it will not be shown again.

2. 2

   Configure SCIM in your IdP

   In your IdP's provisioning settings, enter the BlueWhale SCIM base URL and the token you generated.

   SCIM base URL: https://enterprise.bluewhalestack.com/scim/v2/<ORG_ID>
   Token:         <GENERATED_TOKEN>

3. 3

   Map IdP groups to BlueWhale roles

   In BlueWhale Stack, map each IdP group (by group name or ID) to one of the four platform roles. Users in multiple groups are granted the highest applicable role.