Request for Guidance on Seamless User Authentication Migration to own identity/authentication system

Forum
,
1

Hello Cumulocity Support Team and Forum people;

We are planning to use our own identity/authentication system for user login.

Our main goal is to make this migration as seamless as possible for end users. In particular:
We do not want to send password reset links to users.
We want users to continue logging in with their existing passwords after migration.
Therefore, we would like to understand whether Cumulocity supports any official approach for password continuity during migration.

Is it possible to access user password hash data via Cumulocity APIs or admin tools?
If not, is there any officially supported migration scenario that allows continuity with existing passwords?
Do you have any reference architecture or technical documentation for this type of migration?

2

There is no official API to extract any authentication info. I presume, it’s best to contact Cumulocity Professional Services if you need guidance on a migration like this.

It is quite common that customers switch from the built-in authentication to a SSO provider, but if I understand correctly, you don’t have this SSO provider yet, but you want to build/configure it with the user and authentication information within Cumulocity. Is such a thing even supported by the SSO provider?

3

In addition to Christophs comment: I understand that it might be the the best experience for users if all credentials are the same and no password change is required, for security reasons I would never migrate any existing passwords from a platform to a identity provider (IDP) for multiple reasons:

  1. The password selected at cumulocity might be considered too weak for the IDP and other systems the IDP is integrated to.
  2. Cumulocity might be only one of many systems integrated to the new IDP, using the Cumulocity credentials does not make much sense.
  3. Sharing passwords across systems is always a security risk - for that reasons NO API at Cumulocity every exposes any passwords (clear text or hashes).

I would advise you to initiate setting up new passwords for the selected new IDP and integrate them via SSO (OAuth 2.0 etc.) into Cumulocity. The Cumulocity credentials are not affected by that just the way how user can login.

4

Thank you for your responses. We are currently discussing the process with the primary provider.