Your identity provider now manages CTFreak users
Single sign-on solved the login problem a long time ago. What it never solved is everything around the login: creating the account before the newcomer’s first day, adding them to the right teams, and, more importantly, removing their access on the day they leave. That last step has a habit of being forgotten, sometimes for months.
CTFreak 1.40.0 closes that gap with SCIM provisioning. Your identity provider (Okta, Microsoft Entra ID, Authentik, and any other SCIM 2.0 compatible directory) now pushes users, teams and team memberships to CTFreak automatically. You manage people in one place, and CTFreak simply follows.
What changes for you
Onboarding takes zero clicks in CTFreak. Assign a new hire to the CTFreak application in your identity provider, and their account shows up already attached to the right teams. Since roles and project access are granted to teams, they can log in and get to work without an administrator touching anything.
Offboarding is immediate and complete. Deactivate someone in your directory and their CTFreak access is revoked in the same sweep, along with their other tools. No orphaned accounts, no stale credentials left behind. If they come back, reactivation restores everything as it was, team memberships included.
Teams stay in sync with reality. Reorganizations, transfers, new departments: every group change made in your identity provider is mirrored in CTFreak. Your automation permissions always reflect the current org chart, not the one from last quarter.
Auditors get a straight answer. Provisioned users and teams are read-only in CTFreak: nobody can create an account, rename it or reshuffle a provisioned team from the CTFreak UI. Whether someone should still have an account, and which groups they belong to, is decided in your directory and nowhere else.
Only provisioned users can log in. With a SCIM-enabled auth provider, CTFreak no longer creates accounts on first login. If someone is not in the assigned scope of your directory, they are politely refused at the door.
What stays under your control
Local users and teams keep working exactly as before, and a provisioned user can still be added to an internal team when you need a CTFreak-specific permission construct. For now, administrator rights are also still granted from CTFreak rather than from your directory (this may evolve in a future release).
Getting started
The documentation walks through the exact steps for Authentik, Okta and Microsoft Entra ID, including the few provider-specific details that tend to trip people up.
NB: SCIM provisioning requires a BUSINESS Edition license or higher.