Zero-Touch Onboarding

The Hidden Problem

You've set up MCP servers for your team. Now what?

Most teams end up with one of two bad options:

1. Shared credentials — Everyone uses the same API key.
2. Manual provisioning — IT manually grants access to each user.

There's a better way: let your identity provider handle it.

Gatana's Approach

Gatana implements zero trust principles access through two mechanisms:

• OIDC Token Trust — Accept access tokens directly from your corporate IdP
• Claim-Based Mapping — Automatically apply the right permissions based on token claims

The result: a new employee authenticates once, and Gatana knows exactly which tools they can access and which credentials to inject—based entirely on who they are in your IdP.

┌──────────────┐                              ┌─────────────────┐
│   End User   │──── Authenticates ──────────►│  Corporate IdP  │
└──────────────┘                              │  (Okta, Entra)  │
                                              └────────┬────────┘
                                                       │
                                              Access Token with claims:
                                              { team: "platform", role: "engineer" }
                                                       │
                                                       ▼
                                    ┌─────────────────────────────────┐
                                    │         Gatana Gateway          │
                                    │                                 │
                                    │  ✓ Validates token signature    │
                                    │  ✓ Extracts claims              │
                                    │  ✓ Maps to profile & team       │
                                    │  ✓ Injects scoped credentials   │
                                    │                                 │
                                    └─────────────────────────────────┘
                                                       │
                       ┌───────────────────────────────┼───────────────────────────────┐
                       ▼                               ▼                               ▼
              ┌─────────────────┐              ┌─────────────────┐              ┌─────────────────┐
              │  Logz.io MCP    │              │   GitHub MCP    │              │   Jira MCP      │
              │  (team token)   │              │  (user OAuth)   │              │ (org API key)   │
              └─────────────────┘              └─────────────────┘              └─────────────────┘

How to Enable

1. Enable OIDC Token Trust

Configure Gatana to accept access tokens from your identity provider:

1. Go to Settings → Authentication
2. Add your OIDC provider (Okta, Microsoft Entra, Auth0, etc.)
3. Enable OIDC Access Token Trust

Any valid access token from your IdP with the Client ID from step (2) can now authenticate to Gatana. Users are automatically provisioned on first access—no manual setup required.

2. Create Profiles with Credential Overrides

Profiles let you inject team-specific credentials for tools that don't support per-user OAuth:

1. Create a profile (e.g., platform-team)
2. Add the relevant MCP servers
3. Configure credential overrides with team API keys
4. Disable Open to All to restrict access

3. Map Claims to Profiles

The key to zero-touch access: map IdP claims to profiles.

In the profile settings, add claim mappings:

Now anyone whose token contains team: platform automatically gets the platform-team profile applied—with all its servers and credentials.

Day-one experience:

1. New hire is added to platform team in your IdP
2. They open their AI assistant
3. Gatana validates their token, sees the team: platform claim
4. They immediately have access to the right tools with the right credentials.

Related Documentation

• Identity Federation — Configure OIDC/SAML providers
• Profiles — Credential overrides and claim mappings
• Credentials — How credential scoping works
• Agent-2-Agent — How Gatana enables Agent-2-Agent architectures