Applies to: Integrations between Clio Operate and a system you host, on your own network or in your own Azure tenant
Read this article if:
- You are planning an integration between Clio Operate and a system you host, either on your own network or in your own Azure tenant.
- You have been asked which connectivity option your integration needs.
- You want to understand what each option does, and what it does not do, before it is scoped or purchased.
Overview
Clio Operate runs in Microsoft Azure. Most integrations work over the public internet using HTTPS, and need no special connectivity.
Some integrations need a private network path. That happens when the system Clio Operate must reach is not reachable from the internet, or when your security policy does not allow that system to be exposed. Three options cover these cases:
- Site-to-Site VPN, for systems on your own network.
- Private Link, for databases and other resources hosted in Azure.
- Outbound IP allow-listing, for internet-facing systems you want to restrict to Clio Operate only.
Each option solves a different problem. They are not alternatives to one another, and choosing correctly matters, because each option is scoped separately and one provisioned for a given purpose cannot be repurposed for another. Where an application on your network only accepts Windows Authentication, the Identity Proxy is added on top of a Site-to-Site VPN, and it is not a standalone option.
Note. Access to Clio Operate itself is separate from these options. See How you access Clio Operate below.
Choosing the right option
Start with the traffic your integration needs, and follow the branch that matches it to the recommended option.
Summary
| What you need | Recommended option |
|---|---|
| Clio Operate needs to reach a system on your own network, such as a practice management or document management system | Site-to-Site VPN |
| Clio Operate needs to read the migration-schema database you host in your Azure tenant | Private Link |
| Clio Operate needs to reach another database of yours, or use a non-standard protocol or authentication (e.g. SOAP/XML) | Site-to-Site VPN plus a custom Operate plugin (C#) |
| Clio Operate needs to reach an on-premises API that only accepts Windows Authentication | Identity Proxy, over a Site-to-Site VPN |
| You want only Clio Operate to reach an internet-facing system of yours | Outbound IP allow-listing |
| You want to restrict who can sign in to Clio Operate, or from where | Conditional access in your identity provider |
| You want your users to reach Clio Operate over a private connection instead of the internet | Not available. All application traffic uses the internet-facing gateway |
Site-to-Site VPN
What it is for
You need this if Clio Operate has to reach a system that lives on your own network. Typical targets are a practice management system, a document management system, or a SQL Server holding data for a migration.
Without it, those systems stay unreachable from Clio Operate unless you expose them to the internet, which most firms' security policies do not allow.
How it works
An Azure Site-to-Site VPN creates an encrypted IPsec tunnel between your network and your Clio Operate environment in Azure. Clio Operate then reaches your system across that tunnel using its internal IP address.
Not supported. The VPN carries traffic from Clio Operate out to your systems. It does not carry traffic into Clio Operate, and it cannot be used to route your end-users to the application. All traffic into Clio Operate arrives over the internet through the Clio Operate application gateway and web application firewall. This applies to every customer. If you are buying a VPN so that your people can reach Clio Operate over a private connection rather than the internet, it will not do that.
Best suited to
Server-side integrations, reporting feeds, data migration from an on-premises database, and any case where Clio Operate initiates the connection to a system that lives on your network.
One connection per environment tier
Production and non-production environments are separated at the network level, and a connection cannot span the boundary between them. Production is provisioned with its own separate set of connectivity. Non-production environments (dev, test, performance, and data-migration) generally share one set of connectivity between them. VPN connections are contracted per connection and per environment tier, so an existing entitlement may cover a new requirement, or may need to be extended rather than replaced.
The Identity Proxy (Windows Authentication add-on)
The Identity Proxy is not a connectivity option on its own. It is an add-on that sits on top of a Site-to-Site VPN for one specific case: an application on your network whose API only accepts Windows Authentication, such as Aderant. Clio Operate cannot present a Windows domain identity from Azure, so without the proxy that API cannot be integrated.
You install the proxy on a server inside your own network. Clio Operate calls it across the VPN, over HTTP or HTTPS depending on how the proxy is configured, presenting an API key. The proxy validates the key, then forwards the request to your internal application, authenticating as its own Windows service account.
Note. The Identity Proxy is not related to the Clio Operate Proxy API, which is an application-layer feature used with linked services. See Overview of linked services and the proxy API.
Private Link
What it is for
You need this if Clio Operate has to read a database you host in your own Azure tenant without that traffic crossing the public internet. Direct database connectivity over Private Link is supported specifically for the database that hosts the Clio Operate migration schema, typically an Azure SQL database used as the source for a data migration. Reaching any other database of yours works differently. See Integrating with your systems.
The outcome is that the data path stays on the Microsoft network, and access is limited to the single resource you nominate rather than to your wider network.
How it works
Azure Private Link places a private endpoint in one party's virtual network that reaches a single designated resource in the other party's tenant. Traffic travels over the Microsoft backbone. A private link does not join the two networks together, and it gives no access to anything beyond the one resource it targets.
Important. A private link is one-directional by design. It lets Clio Operate reach the one database you nominate, and nothing else in your network. It needs its own private endpoint, its own approval step, and its own DNS configuration, set up in the tenant that owns the database.
DNS is the part that most often goes wrong
Private Link works only when the hostname resolves to the private endpoint address rather than the public one. Three things must be in place:
- A record for the endpoint in the correct Azure private DNS zone.
- A link between that DNS zone and the virtual network that needs to resolve the name.
- A conditional forwarder on your domain controllers sending the private DNS zone to Azure DNS, ahead of any public DNS server in the forwarder list.
Important. Do not use a local hosts file entry to work around name resolution. Mapping an Azure SQL hostname to an IP address in a hosts file breaks the TLS handshake and returns error 40532. Name resolution must go through the private DNS zone.
Best suited to
Reading the migration-schema database you host in Azure, where you want to keep traffic off the public internet.
Outbound IP allow-listing
What it is for
You need this if you have a system that is already reachable over the internet and you want to narrow access so that only Clio Operate can reach it. It is the lightest of the three options. There is no tunnel to build and no software to install, so it is worth ruling in or out before you consider a VPN.
How it works
Clio Operate presents outbound traffic from a known public IP address. You allow that address on your firewall and refuse everything else.
Important. This applies to outbound traffic from Clio Operate only. It does not restrict who can sign in to Clio Operate. Production environments have their own outbound IP address. Non-production environments share an outbound address across environments and customers, so allow-listing a non-production address does not restrict access to your organisation alone.
Best suited to
Integrations where your system is already reachable over the internet and you want to narrow access, at lower cost and complexity than a VPN.
Integrating with your systems
The options above open a network path. What Clio Operate can do across that path depends on the type of system it is integrating with.
REST and HTTP systems
Integration is most straightforward with REST or HTTP systems that authenticate with OAuth or an API key. Clio Operate supports these directly:
- OAuth 2.0 Authorization Code flow
- OAuth 2.0 Client Credentials flow
- An API key presented in a request header
Databases
Direct database connectivity is supported for the database that hosts the Clio Operate migration schema, either an Azure SQL database reached over Private Link or an on-premises SQL Server reached over a Site-to-Site VPN. Reaching any other database of yours is supported over a Site-to-Site VPN together with a custom Operate plugin.
Anything else
Other authentication mechanisms, or protocols such as SOAP or XML, can be supported through a custom Operate plugin (C#). A custom plugin is a development engagement, scoped with your account team.
Note. Windows-Authentication APIs are the one case handled by a dedicated component rather than a custom plugin. See the Identity Proxy above.
How you access Clio Operate
Access to the Clio Operate application is handled separately from all of the connectivity options above. All application traffic reaches Clio Operate over the internet, through the Clio Operate application gateway and web application firewall. VPN and Private Link do not apply to this layer and cannot be used as an alternative route into the application.
Access is controlled by:
- Your single sign-on configuration. Clio Operate authenticates your users against your identity provider.
- Conditional access policies in your identity provider. Where you want to restrict sign-in by IP address, location, device, or risk level, you configure that in your own identity provider. Clio Operate does not apply IP restrictions to application sign-in.
Not supported. Clio Operate cannot apply IP allow-listing to application sign-in. Restrictions on who can sign in, and from where, are configured in your identity provider's conditional access policies. If you require IP-based restriction on portal access, plan for it in your own tenant.
What is not currently supported
These come up often enough that they are worth stating plainly.
| Ask | Why it is not offered |
|---|---|
| A private network route into the Clio Operate application for your end-users | All application traffic uses the internet-facing gateway. VPN and Private Link do not carry application traffic. |
| Clio-side IP allow-listing on application sign-in | Sign-in restrictions are configured in your identity provider's conditional access policies. |
| Private Link to resource types other than Azure SQL, such as APIM | Private Link is supported for Azure SQL. Other resource types are not currently a supported pattern. |
| Two-way, bidirectional private links | A private link is one-directional by design. A single bidirectional connection is not offered. |
| Certificate-based VPN authentication (IKEv2 with machine certificates) | Site-to-Site VPN uses a pre-shared key; a certificate option is not currently available. |
| One connection serving both production and non-production | Environments are network-isolated; a connection cannot span the production and non-production boundary. |
| Reusing a connection provisioned for one purpose for another | Each option is scoped to a specific resource and direction, and is not transferable. |
What we need from you
For a Site-to-Site VPN
| Item | Notes |
|---|---|
| Public IP address of your VPN device | The peer address the tunnel connects to. Provide both peer addresses if your device is active-active. |
| Device make, model, and firmware version | Determines the supported IPsec parameters. |
| On-premises address ranges | The internal subnets Clio Operate needs to reach. |
| Pre-shared key | Sent using a one-time secret link, never by email or on a ticket. |
| Firewall change on your side | To permit traffic from Clio Operate to the target system. |
Important. Do not send the pre-shared key by email, on a support ticket, or in any chat or logging system. Use a self-destructing link such as One-Time Secret. If a key has been sent over an insecure channel, generate a new one and send it again securely.
For a Private Link
| Item | Notes |
|---|---|
| Azure Resource ID of the target resource | Identifies exactly what the link reaches. |
| Target sub-resource type | For example, a SQL server. |
| Approval of the pending connection | The tenant that owns the target resource approves the request. |
| DNS configuration in your tenant | Required for the direction that points at your resource. |
| Network Contributor permission | In whichever tenant is creating or approving the endpoint. |
For the Identity Proxy add-on (on top of a VPN)
| Item | Notes |
|---|---|
| A Windows server on your network | Joined to the same Active Directory domain as the target application. |
| Network and DNS access from that server | To reach the target application. |
| A dedicated Windows service account | With permission to authenticate against the target application. |
| An inbound network path from Clio Operate | The Site-to-Site VPN. Clio Operate support provides the installation package and configuration guide. |
For an on-premises SQL Server used in data migration
| Item | Notes |
|---|---|
| SQL Server 2019 or later | Earlier versions are not supported. |
| A SQL login | The connection uses SQL Authentication rather than Windows or integrated authentication. |
| Internal IP address of the server | Used to extend the connection to that server. |
| Read access for the migration account | Read-only access is sufficient. |
| Firewall change on your side | To permit traffic from Clio Operate to that server. |
Where the staging database is Azure SQL rather than on-premises, the connection patterns are different and are covered in Data Loading Principles and Practices.
Security questions we are often asked
Can Perfect Forward Secrecy be enabled?
Yes. ECP256 and ECP384 are both available. Both sides must enable Perfect Forward Secrecy with a matching Diffie-Hellman group, otherwise the tunnel will not establish. Confirm your preference during scoping.
Can we use certificate-based authentication (IKEv2 with machine certificates) instead of a pre-shared key?
Not currently. A pre-shared key is the standard configuration for Site-to-Site VPN connections.
Can the IKE Phase 1 security association lifetime be changed?
No. Azure fixes the Main Mode security association lifetime at 28,800 seconds and it is not configurable.
How are production and non-production environments kept separate?
Environments are separated into different Azure virtual networks. Those virtual networks are not peered to one another, only to shared services, and network security groups provide further segmentation. VPN traffic to a non-production environment cannot reach production, and the reverse is also true.
Before you buy
Connectivity requirements vary depending on whether the system Clio Operate needs to reach is on your network or hosted in Azure, and how it authenticates. The wrong option cannot be adapted after the fact. Confirm the following with your account team before any connectivity option is scoped or purchased:
- Which system Clio Operate needs to reach, and where it is hosted, whether on your network, in your Azure tenant, or reachable over the internet.
- Which environments are in scope, because production is provisioned separately from non-production.
- What authentication the target system supports, because Windows Authentication changes the answer.
- Whether your contract already includes the connectivity you need, or whether it needs to be extended.
Note. A Site-to-Site VPN carries an additional operating cost. Your account team confirms pricing and what your contract already covers.
Where to go with questions
If you are not sure which option applies to your situation, raise it with your Customer Success Manager or open a ticket with Clio Operate support. Bring the four points listed in Before you buy and the answer is usually clear in one conversation.
Related articles
- Clio Operate System Requirements
- Application Integration
- Compliance and Security
- Overview of linked services and the proxy API
- Overview: iManage Integration
- Data Loading Principles and Practices