Custom Zones

A Zone is a security domain for a set of users, Applications, and Resources. Custom Zones support advanced use cases, such as building systems with a different set of external users than your organization for example, a customer-facing product with its own user pool, or separate environments with their own security controls.

Because a custom Zone has its own users, it requires additional configuration beyond creating it:

1. An organization Admin must assign explicit management access to the Zone, including themselves.
2. The Zone needs an Identity Provider so its users can sign in: either your Organization Zone, or an external Identity Provider such as Okta, Auth0, or Google.

Only organization Admins can create Zones and assign Zone access. See Roles & Permissions.

1. Open the Zones page

   In Keycard Console, click Zones in the sidebar.

2. Create the Zone

   Click Create Zone, enter a Name, and click Create.

Custom Zones have their own management roles: Manager (full access to the Zone) and Viewer (read-only). An organization Admin must assign these roles explicitly.

1. Open the People page.
2. Find the member and click the ⋯ button on their row to open their access drawer.
3. Under Zone access, choose Manager for the new Zone.
4. Repeat for yourself and anyone else who needs to manage the Zone.

See Roles & Permissions for details on organization and Zone roles.

Every custom Zone needs an Identity Provider so its users can sign in. There are two options.

Every Keycard Zone can act as an Identity Provider for other Zones. If the custom Zone’s users are members of your organization, connect your Organization Zone as the custom Zone’s Identity Provider. Users then sign in to the custom Zone with their organization accounts.

1. Copy your Organization Zone’s Issuer URL

   In Keycard Console, go to Settings → Connection and copy the Issuer URL of your Organization Zone.

2. Create a Provider in the custom Zone

   1. Switch to the custom Zone, click Providers in the sidebar, and then Add Provider.
   2. Enter a Name, such as “Organization”.
   3. In the Issuer URL field, enter the Organization Zone’s Issuer URL you copied.
   4. Click Connect.

3. Select the Provider for the Zone

   1. Go to Zones, open the ⋯ menu on your Zone’s card, and select Settings.
   2. On the Settings tab, in the Zone sign in configuration section, open the Identity Provider dropdown and select the Provider you just created.
   3. Click Save Changes.

If your Zone’s users already have accounts in an Identity Provider such as Okta, Auth0, or Google, connect it and select it as the Zone’s Identity Provider. Users then sign in to the Zone with their existing accounts.

1. Connect your Provider by following Identity Providers.
2. Go to Zones, open the ⋯ menu on your Zone’s card, and select Settings.
3. On the Settings tab, in the Zone sign in configuration section, open the Identity Provider dropdown and select your Provider.
4. Click Save Changes.

For end-to-end Provider setup, see the Okta and Auth0 tutorials.

• Control what the Zone’s users and agents can access with Access Policies.
• Add Applications and Resources to the Zone.