DPoD IDP Migration FAQ
This document contains frequently asked questions and answers about the DPoD IDP migration and additional details about impacts to DPoD users.
The following document refers to single tenant users and multi tenant users. Single tenant users refer to a user whose email address is registered to a single DPoD tenant. Multi tenant users refer to users whose email address is registered to multiple DPoD tenants.
Questions - General
What is changing?
Thales is changing the Identity Provider (IDP) used in the DPoD platform to Thales OneWelcome. This update enables the platform to provide modern authentication options as well as simplifying logins for users that manage multiple tenants on the platform.
As a result of this IDP change tenant vanity URLs will no longer exist and all users will log in to their DPoD tenant from a common login portal.
Will this migration be deployed to the two regions separately?
Thales will migrate one region and then will migrate the remaining region at a later date.
The migration date for the two regions will be shared through the DPoD status page, changelog, and this document when available. We recommend subscribing to the status page and changelog to receive emails with the latest updates.
When is the migration happening?
The migration will occur towards the end of 2024 or early in 2025. No migration date has been announced.
The migration date will be shared through the DPoD status page, changelog, and this document when available. We recommend subscribing to the status page and changelog to receive emails with the latest updates.
Will there be a maintenance window for the migration?
Yes, a maintenance window for the migration will be announced through the DPoD status page. We recommend subscribing to the status page to be alerted of this and any other maintenance events on the DPoD platform and services.
What is the overlap period between the old UAA IDP and the new OneWelcome IDP?
On the changeover date the old UAA IDP will be disabled effective immediately and authentication requests will be directed to the new Thales OneWelcome IDP.
How do I identify my tenant moving forward?
You can identify your tenant using the tenant id. The tenant id is available from a logged in tenant under the user email address in the top right corner of the DPoD tenant user interface.
Questions - Authentication
Will my login credentials change?
Single tenant users - You can continue to log in to the new Thales OneWelcome portal using the same credentials as before. You will need to register a new MFA OTP on your device.
Multi tenant users - With the new authentication system users will use a single login to authenticate to any of the tenant accounts they are a member of. This is a significant improvement for managed service providers that are today managing multiple tenants on behalf of their customers, as well as users that are maintaining tenant accounts in different HSM regions for data sovereignty requirements. More information on impacts to multi tenant users will be shared at a future date. You will need to register a new MFA OTP on your device.
What do I need to do to migrate?
Thales will handle the IDP migration.
Single tenant users - You will receive an email to register a new MFA OTP on your device.
Multi tenant users - You will receive an email to register a new MFA OTP on your device.
How do I login after the migration?
After the migration to the new Thales OneWelcome IDP you will log in through a common login portal. The new login portal is currently under development and the URL will be shared at a future date.
Single tenant users - On log in to the common login portal single tenant users will be redirected to their DPoD tenant.
Multi tenant users - On log in to the common login portal multi tenant users will view a list of DPoD tenants that the credentials are registered to. Multi tenant users will select a tenant from the list and be redirected to the selected DPoD tenant.
Following the migration we recommend you update any bookmarks to use the new login page as access to the previously used tenant login URLs will be removed.
What if I am a multi tenant user and I do not want this change?
If you require keeping the logins for different tenants separated it will require that each tenant uses a unique email address. Please contact Thales Customer Support for assistance in the creation and removal of user accounts.
Are there any changes to API credentials?
Platform and service API credentials will continue to function as normal. Existing requests to vanity login URLs will be redirected to the common login portal. The new login portal is currently under development and the URL will be shared at a future date.
At a future date any existing automation/scripting should be updated to use the common login portal URL and marketplace URL for generating a JWT and calling the platform or service API.
Do I need to regenerate API Credentials?
No, all platform and service client credentials will be migrated to the new IDP.
Who do I contact for assistance logging in?
Single tenant users - Following the migration you will receive an email informing you that the migration has been completed and the email will direct you to login to the new portal and reset your MFA OTP.
Multi tenant users - Following the migration you will receive an email informing you that the migration has been completed and the email will direct you to login to the new portal and reset your MFA OTP.
If you have forgotten your password you can use the self service tools on the Thales OneWelcome login page to submit a forgot password request.
If you are a newly registered user, you will receive a registration email. If the registration email code expires you can use the self service tools on the OneWelcome login page to request a new registration email.
If problems with logging in persist please contact your tenant administrator. If your tenant administrator is unavailable to assist please contact Thales Support.
Can I log in to tenants in different regions using the same login?
Yes, for multi tenant users after the migration a single login can be used to access tenants in any DPoD region.
Questions - Administration
How do I reset other account passwords in my tenant?
This capability has been removed to prevent an administrator from handling a user's credentials. Users can use the forgot password functionality on the Thales OneWelcome login portal to reset their own password.
Are there changes to creating/registering new users?
When manually registering a new user, administrators no longer set an initial password. Registered users receive an email invitation to validate their email and create their user credentials.
The custom service provider sign up pages have been deprecated. New users can register at https://market.dpondemand.io/signup.
Service provider administrators can create a custom registration page using the DPoD Platform API /tenants endpoint or can register users manually using the DPoD service provider tenant user interface.
If the registration email code expires users can use the self service tools on the Thales OneWelcome login page to request a new registration email.
Can I still add a Service Provider logo to my tenant?
Yes, service provider administrators can still add a logo to their tenant. Service provider logos will no longer display on the IDP login pages. Service provider logos will continue to display in the tenant user interface.
Questions - Luna Cloud HSM
Do I need to download a new Luna Cloud HSM client?
No, as long as you are using a client that is supported by the Luna Cloud HSM service. For more information see Universal Client Supported Versions with Luna Cloud HSM.
Do I need to make changes to my Luna Cloud HSM client?
No changes are required to any Luna HSM client configuration. Authentication requests will be redirected automatically to the new IDP.
If you are restricting network egress requests using domain names you will to include the new list of Thales OneWelcome domain names. The Thales OneWelcome domain names are under development and the URLs will be shared at a future date. For more information about include listing DPoD Luna Cloud HSM FQDNs see Client Network Connectivity.
