Skip to main content

Create your first environment

The First environment track takes you from a new account to a call that PolicyArc governs, and then to a call it denies. This page covers steps 2 to 4. You create an environment, connect the identity provider your users sign in with, and add a connector that needs no credentials of its own.

StepPageYou finish with
1. Create your accountCreate your accountAn active account
2. Create an environmentThis pageA running environment
3. Connect an identity providerThis pageUsers can sign in
4. Add a connectorThis pageThe weather tools on your gateway
5. Make your first callMake your first governed callAn allowed call under Access Activity
6. Deny a callDeny your first callA denied call with its reason, then a rollback

Before you start​

  • An active account. See Create your account.
  • An identity provider that holds your users, and permission to register an OAuth app in it. The form has presets for Google, Microsoft, Okta, Atlassian, Dropbox, Figma, Gitea, GitHub, GitLab and HubSpot, and a Generic OIDC option for any other OpenID Connect provider.

Create an environment​

An environment is your own authorization server and policy engine, with a gateway in front of the tools you connect.

We have not run this step end to end yet.

  1. In the dashboard, open Environments and select New environment.
  2. Enter a Name, for example First environment. The name is for display only. The environment's address is assigned for you.
  3. Select Create environment.

The dashboard shows Provisioning your environment… until the environment is ready. When it is, the environment card shows RUNNING.

Your plan sets how many environments you can create. See Plans and limits.

Open the Admin Portal​

On the environment page, select Open admin portal. The rest of this page and the next two happen in the Admin Portal. Its menu has three groups.

  • Operate holds Overview, Access Activity and Policy.
  • Configure holds APIs & Connectors, Users & Identity and Clients & Agents.
  • System holds Secrets and Advanced.

Connect an identity provider​

When a user signs in, PolicyArc sends them to your identity provider and trusts the answer.

  1. Under Configure, select Users & Identity. The IdPs tab lists Identity Providers. Select Create.
  2. On Add a sign-in provider, under Pick a provider, select your provider. The preset fills in the scopes and, for most providers, the issuer URL. Okta asks for your Okta domain. Microsoft asks for a Tenant ID. For GitLab and Gitea, enter the issuer URL yourself. For a provider without a preset, select Generic OIDC and enter its issuer URL.
  3. Under Add this redirect URI to your IdP, select Copy. Register that URL as the redirect URI of an OAuth app in your provider's console.
  4. Under Paste the credentials from your IdP, fill in the fields below, then select Add identity provider.
FieldWhat to enter
Provider keyA short slug such as google. Lowercase, no spaces.
Display nameThe name the Admin Portal shows for this provider.
Issuer URLFilled in by most presets. Otherwise your provider's OpenID Connect issuer.
Client ID and Client secretFrom the OAuth app you registered. The secret is stored encrypted and never shown again.
ScopesThe preset fills in openid email profile.

Leave the Enabled box selected. PolicyArc has no sign-in page that lists providers. /authorize sends the user to the provider that the idp_selection control picks, and refuses a disabled one (AuthorizeService.java).

The provider pages walk through the console side for Google, Microsoft Entra ID, Atlassian and GitLab.

If this is your first enabled provider, you land on the Overview page with the message Sign-in provider added. Next: connect a resource to start serving tools. Otherwise you land on the provider list with Identity provider created successfully.

Add the weather connector​

The Open-Meteo Weather connector wraps a public weather API that needs no account and no key. It lets you make a governed call before you set up any upstream OAuth app.

  1. Under Configure, select APIs & Connectors, then + Connect a resource.
  2. Select the Open-Meteo Weather card. It is in the Ready to add group.
  3. The page says Access policy installed. The connector needs no setup fields. Select Connect.
Connect a resource page with the Open-Meteo Weather card

You should land on the resource's page with the message Connected Open-Meteo Weather as 'weather-openmeteo'. The resource name weather-openmeteo is the connector id without its vendor prefix. The connector adds three tools to your gateway: current_weather, daily_forecast and hourly_forecast. See Open-Meteo Weather for what each tool does.

Next​

Continue to Make your first governed call.