Access Management

Being able to add custom text in some capacity to the IDP login pages would allow better explanation to end users about things like username format. For example, indicating to the user whether they should be using their email address versus their standard username.

As an administrator I do not want to be able to disable the entire local login IDP. Disabling the local login can cause many issues since when the main IDP is in error it is not possible to login as a local administrator anymore. Instead of disabling only the hide option should be available. If restricting the local login is required portal access rules targeted on the Local IDP could be applied.

We would like to have audit logging on the user and group membership changes. This way we can determine what happened when and what was the situation in the past.

Currently we only support the basic attributes to be synced between AzureAD and HelloID. This is caused because the schema on AzureAD application is static and cannot be changed dynamically. But we noticed a desire to synchronise the manager and employeeid. Therefore we added those attributes in the synchronisation altough the settings are limited. The employeeid is put in the additional attributes of a user with the name 'employeeID' which cannot be changed. The manager is calculated to a HelloID user based on based effort (could result in a empty value if the HelloID user is created before the HelloID user account of the manager exists). Please rerun the update if this is the case so after the HelloID user of the manager is created.

We would like to have more insights about the emails that are sent in HelloID. So that we can look back and see if an email is sent with no errors and to who. An overview of sent notifications. Based on specific events HelloID sends out (customized) notifications. We would like to be able to confirm if certain notifications have been sent, and when, through an audit-like overview. Solution: All the email notifications sent through HelloID are available in the audit logging and are shown in a default report. The email audit log contains the following information: from, to, cc, bcc, subject, date sent, status, and source (part in HelloID from where the notification is triggered)

We want to enable DMARC on helloid.com mail domain. This is to monitor the mail traffic send from helloid.com and to prevent misuse of the domain.

We want to deprecate the iframe/embed integration which means that all URL's using /app/iframe/{page} will become obsolete. This is decided because this functionality isn't used often but requires a lot of maintenance which hold back the time and effort we would like to spend on other/new features.

When using Azure as OIDC for HelloID and opening an application connected to HelloID I always have to enter my emailadress first, after entering the emailadress I will be automatically logged into the application since there is already an active session with Azure AD. To prevent entering the emailaddress in the Azure signon screen the domain_hint parameter can be send with the request to Azure. ( https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/home-realm-discovery-policy#domain-hints ) Is it possible to add support for this parameter? e.g. add &domain_hint=helloid.com to the url.

For HelloId we have added AzureAD as Identity provider (OIDC link). What we want is that AzureAD handles all MFA. But what we noticed is that MFA that is being handled by AzureAD could not be handled by an SSO application which is linked in HelloID (Nedap ONS). If we added an portal access rule within HelloID we do not have to do not any MFA actions as user if we already accomplished MFA within AzureAD for the same user. So HelloID detects MFA. As mentioned in this Feature request: Support AMR claim from OIDC IDP | Voters | HelloID But we noticed that is AMR claim is NOT being transferred to Nedap ONS within HelloID. (Because Nedap ONS wants is still request for his own MFA). We want that MFA claim will be transferred to the SSO application Nedap ONS (require MFA) so that we are able to login. Would be great if this is implemented in the next run. For this HelloID support ticket was 20210929-050 requested, outcome of the support ticket was log an feature request.

We would like to link to the groups so we can see the users more easily when editing an application