How to Configure Persona Profiles for IGEL Contextual Access

IGEL Contextual Access (ICA) extends the IGEL Adaptive Secure Desktop by using contextual signals to determine what a user should receive when they connect to an IGEL OS device. Instead of treating every device the same way, ICA enables IT to deliver workspace controls and resources based on the user’s context. Persona Profiles enables the persona-based layer of ICA through the IGEL Universal Management Suite (UMS).

With Persona Profiles, configurations and applications are assigned to user personas rather than individual devices. When a user signs in to an IGEL OS 12 device through Single Sign-On (SSO), the IGEL UMS uses role information from the Identity Provider (IdP) to activate the appropriate persona profile. This allows different user types to receive a personalized, role-specific desktop with the applications and settings they need. Through Persona Profiles, IT can manage access at the persona level instead of device by device.

How Persona Profiles Work

1. The administrator configures persona profiles in the UMS. See the How to Configure Persona Profile section below.

2. The user logs in to an IGEL OS 12 device via SSO.

3. The Identity Provider authenticates the user and provides role information to the UMS.

4. The IGEL UMS evaluates the user’s role and applies the persona profile based on the role and the device.

5. Assigned configurations and applications are dynamically applied based on the persona profile.

6. On logout, the session is cleared and settings are removed.

Prerequisites

External IdP Configuration

• Supported cloud IdP providers with Persona Profiles:

  • Okta

  • Ping

  • Microsoft Entra ID

Feature Enablement

• The Persona Profiles feature is enabled in the UMS under System > Settings > UMS Features. See System Settings in the IGEL UMS Web App.

• User has access to the Persona Profiles tab. See How to Manage Object Permissions in the IGEL UMS Web App

• Licenses: IGEL Contextual Access Add-on License and UMS Enterprise License

Version Requirements

• IGEL UMS 12.12.100 or higher

• IGEL OS 12.9.0 or higher

Connect the UMS to an Identity Provider for Persona Profiles

Persona Profiles use role information from the access token issued when a user signs in to an IGEL OS device. The device sends the token to the IGEL UMS, which validates the token, reads the configured role claim, and selects the persona profiles that match the user’s roles.

This process is separate from Single Sign-On (SSO) for UMS administrators. You do not have to configure an IdP connection under User Management or map IdP roles to UMS administrator groups to use Persona Profiles.

Step 1: Configure SSO Login on IGEL OS

→ Configure one of the supported cloud IdPs to enable SSO Login on the devices. For details, see How to Configure Single Sign-On (SSO) on IGEL OS 12.

Step 2: Configure Persona Roles in the IdP

In general, you need the following IdP configuration:

1. Open the OIDC application or authorization server used for IGEL OS SSO.
   

2. Configure an access-token claim containing the persona role or group values.
   

3. Assign the applicable roles or groups to the users.
   

4. Note the exact claim name and the values returned in the claim, you will need them for the UMS configuration.

For example, an IdP might issue the following claim:

{
  "groups": ["Clinician", "Support"]
}

In this example, you will configure groups as the role claim name in UMS and you will use Clinician and Support as the IDP Role values in the persona profiles.

Example Configuration: Microsoft Entra ID App Roles

1. In the Microsoft Entra admin center, go to Entra ID > App registrations.
   

2. Open the application used for IGEL OS SSO.
   

3. Select App roles.
   

4. Click Create app role.

5. Configure the app role:

• • Display name: Enter a descriptive name.

  • Allowed member types: Select Users/Groups.

  • Value: Enter the value to map to a persona profile, for example, Clinician.

  • Description: Describe the purpose of the role.

  • Do you want to enable this app role?: Enable the app role.
    

6. Click Apply.
   

7. Go to Entra ID > Enterprise applications.
   

8. Open the enterprise application associated with the app registration.
   

9. Select Users and groups.
   

10. Click Add user/group.
    

11. Select the users or groups and assign the appropriate app role.
    

12. Click Assign.

The value configured under Value, is included in the roles claim value. Enter this value exactly, including capitalization, when you create the persona profile.

Step 3: Configure the Persona Role Claim in UMS

1. In the UMS Web App, go to System > Settings > Network.
   

2. Locate Claim which contains the roles of a user for persona desktop login.

3. Enter the claim name according to the access-token content. The UMS will read the role of the user from this claim when the user logs in.
   Enter only the claim name, for example umsroles, do not enter an individual role value such as Clinician.

{
  "iss": "https://login.microsoftonline.com/<tenant-id>/v2.0",
  "umsroles": ["Clinician", "Support"]
}

Step 4: Configure Token Trust in the UMS

UMS uses the trusted issuer to obtain the IdP signing keys from its JWKS endpoint. UMS then validates the token signature and expiration before processing the persona roles. Tokens from an issuer that is not in the allowed issuer list are rejected.

To ensure that UMS trusts the authentication tokens issued by the IdP for the persona profile login:

1. Under Allowed Issuer for Persona Desktop login, click Manage.

2. Add the issuer URI of the IdP configured for SSO Login on IGEL OS. Enter the exact issuer URI from the IdP OpenID Connect configuration.

The issuer URI must exactly match the iss value in the access token. For example, for a single-tenant Microsoft Entra v2 token, the issuer normally has the following format:

https://login.microsoftonline.com/<tenant-id>/v2.0

Use Persona Profiles for Access Management

Step 1: Create Persona Profiles for IdP Roles

1. In the UMS Web App, go to Configuration Objects > Persona Profiles
   

   

2. Create a new persona profile.

   

3. Enter Name and Description for easy profile management.

4. List the IdP role names separated by commas under IDP Role to connect the persona profile to these IdP roles.

5. Click Next.

Step 2: Assign Configuration Objects to Persona Profiles

→ Assign configuration objects to the persona profile, like profiles, apps, etc. For more information on configuration objects, see Configuration - Centralized Management of Device Settings in the IGEL UMS Web App.
These configurations will be applied to all users mapped to the corresponding IdP roles.

Once the persona profile is saved, you can assign/remove objects through the Assign Object action.

You can see assigned objects in the Assigned Objects tab.

Step 3: Assign Persona Profiles to Devices

→ Select the devices or device directories for which this persona profile should be active.

This way, the persona profile controls which users can access specific devices.

Example:

• A persona profile linked to a specific IdP role is only active on the assigned devices.

• Users without a matching persona profile cannot log in to the device.

Once the persona profile is saved, you can assign/remove devices through the Assign Device action button.

You can check on the assigned devices in the Assigned Devices tab.