Connect to any provider that conforms to the OpenID Connect specification. The OpenID Connect Provider (ie whatever it is that holds all of the user data) will need to supply a client ID and secret, as well as a discovery endpoint URL.
The provider will also need to know the re-entry target of the Authentication worker, which in a standard installation will be
Provider Linking and Group Mirroring
The standard provider type,
A second version,
We do not allow linking and mirroring with the same provider because an additional login on an account, external to the provider that manages groups, could grant undue access to a user who logs in with that additional login.
Provider Type
- openid_no_link - linking disabled, group mirroring enabled
- openid - linking enabled, group mirroring disabled
Parameters
As well as the parameters described in Base Provider Parameters, the following must be set in the params object.
| Name | Type | Comments | |
|---|---|---|---|
| Required | |||
| clientId | String | The Client ID from the identity provider | |
| discoveryEndpointUrl | String | The location of the provider's discovery document found at a "well-known" location | |
| secret | String | The Client secret from the identity provider | |
| userProfileAttributeMapping | Object | Maps profile properties (left) to the Authentication Worker's UserProfile class fields (right) Only the UNIQUEID field is required. See Site User Profile Mapping for further information "userProfileAttributeMapping": { | |
| Optional | |||
| acrValues | String | The acr_values claim, for example | |
| validateAcrValues | Boolean | Default: true. Whether or not to validate that the values returned from the provider match those sent | |
| authClaims | String | A comma separated list of requested claims | |
| authenticationMethod | String | Default Request to the /token endpoint using the client authentication method, either | |
| authUiLocales | String | Sets | |
| authVtr | String | The vectors of trust to request. A comma separated string, for example "P1.Cb.Cc.Ab,Ce.Ab" | |
| clockSkew | Integer | A number of seconds to allow for discrepancies between clocks on local and remote servers. Default 0 | |
| debugLogging | Boolean | Default: If enabled the JWT Token and Attribute Mapping Values will be logged, simplifying the process of creating a mapping | |
| didEndPoint | String | The url to retrieve Decentralized Identifiers document (DID) for core identity verification | |
| expectedIdentityConfidenceLevel | String | A comma separated string to define the level of identity confidence for your service | |
| nonceEnabled | Boolean | Default: Whether to include nonce parameter for the /authorize endpoint | |
| persistIdToken | Boolean | Default: Persists the | |
| requestPostResponse | Boolean | Default: If true, Form Post Response Mode is enabled. This adds Set as false if the provider expects a multipart response body | |
| requestUserInfo | Boolean | If true the provider will make an additional call to the userinfo_endpoint to retrieve information. In most circumstances this is not needed as the data is in the | |
| responsetype | String | Space delimited list of responses requested. Any of: Default: | |
| scopes | String | Space delimited scopes to request from the provider Default: | |
| shouldUseSingleSignOut | Boolean | Default: Whether or not logging out should terminate the sessions of all applications involved. If false logging out of the iCM powered site will not log the user out of, eg their Azure account | |
| tokenEndpointPrivateKeyAlgorithm | String | Default: Algorithm of private key of signing JWT assertion | |
| tokenEndpointPrivateKeyPath | String | The path to the private key of signing JWT assertion, for example "${APISERVER}/data/auth/ONELOGIN/tokenEndpointPrivateKey" | |
| tokenSigningCertFilePath | String (File path) | Default: Optional path to a PEM encoded .cer file containing the certificate to use. Certificates should be stored in the ${APISERVER}/data/auth directory, eg ${APISERVER}/data/auth/openid-providername/openid-token-signing.cer | |
| tokenSigningKey | String | A key to use instead of a certificate | |
| validateTokenMode | String | Mode of validating the JWT returned from endpoints | |
| Group Mirroring | |||
| excludeMirroredGroups | Array<String> | If | |
| excludeMirroredGroupsRegex | String (Regex) | Default: null If | |
| groupAttribute | String | Default: null Name of the JWT token attribute containing the JSON array of groups the user is a member of For example if on the server the attribute 'Token-Groups - Unqualified Names' was mapped to a token name of 'ADGROUPS', the value of this property should be 'ADGROUPS' | |
| includeMirroredGroups | Array<String> | Default: null If defined, only groups in this list of group names or those that match | |
| includeMirroredGroupsRegex | String (Regex) | Default: null If defined, only groups that are either in the | |
| mirrorGroups | Boolean | Default: false If true creates an iCM Site User group structure identical to that returned by the provider. For example, with a provider prefix of "OPENID_" and a user in the following groups:
once authenticated, iCM site user groups with the following names will be created if they do not already exist, and the user added to them:
Mirrored groups are updated every time a user successfully authenticates | |
Example
This example shows three different providers, all using the OpenID type. The first connects to the API Server's own OAuth worker (a premium service).
{
"providerName": "icmOIDC",
"providerDisplayName": "icm OpenID Connect",
"type": "openid",
"userPrefix": "ICMOIDC_",
"params": {
"checkConsentToStoreData": false,
"failIfConsentNotGiven": true,
"clientId": "...",
"secret": "...",
"discoveryEndpointUrl": "https://demosite.gossinteractive.com/apiserver/oauth/http/.well-known/openid-configuration",
"userProfileAttributeMapping": {}
}
}, {
"providerName": "googleOID",
"providerDisplayName": "google OpenID Connect",
"type": "openid",
"userPrefix": "GOID_",
"params": {
"checkConsentToStoreData": false,
"failIfConsentNotGiven": true,
"clientId": "123...456-idj...i0.apps.googleusercontent.com",
"secret": "wmX.....-.....KiQ",
"discoveryEndpointUrl": "https://accounts.google.com/.well-known/openid-configuration",
"userProfileAttributeMapping": {}
}
}, {
"providerName": "azureOID",
"providerDisplayName": "azure OpenID Connect",
"type": "openid",
"userPrefix": "AOID_",
"params": {
"checkConsentToStoreData": false,
"failIfConsentNotGiven": true,
"clientId": "7f0...-...-...-...7de",
"secret": "Zjgq...IKME=",
"discoveryEndpointUrl": "https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration",
"userProfileAttributeMapping": {}
}
}
