Content Comparison

Anchor
ACOIDC ACOIDC

OIDC Configuration

The Open ID Connect (OIDC) Single Sign-on feature provides the ability for users to login to multiple applications with the same login credentials (username and password).

District’s OIDC-compatible Identity Provider, such as Azure AD, ADFS 4.0, or Red Hat SSO 7.0.

Image Added
*Indicates a Required Field

1. Discovery Document URL* - The discovery URL used to configure the OpenID Connect server. Typically this is in the form of https://example.com/path_to_issuer/.well-known/openid-configuration.
   For Azure AD, use https://login.microsoftonline.com/<Azure-AD-Tenant-ID>/.well-known/openid-configuration.
   For RedHatSSO, use the format https://example.com/auth/realms/<realm-name>/.well-known/openid-configuration.
2. Client ID* - The client id to use when communicating with the OpenID Connect (OIDC) server.
3. Client Secret* -The client secret for the above client id to use when authenticating to the OpenID Connect (OIDC) server. For Public Key JWT, use XML representation of the RSA private key corresponding the public key known by the OIDC server.
4. Client Auth Mode* - Use the drop-down menu to select one of the following modes: None, Basic, Post, ClientSecretJwt, PublicKeyJwt.
5. Username Source Mode* - The source of the username to use when authenticating to the OpenID Connect (OIDC) server. For Azure AD, choose UPN.
   Use the drop-down menu to select one of the following source modes: OIDC Subject, Preferred Username, Email Address, UPN (User-Principal-Name).
6. Browser Mode* - The initial display size of the popup-browser to display when performing client-side SSO authentication.
   Use the drop-down menu to select one of the following browser modes: Small, Normal, Maximized.
7. Authorized User Claim Type – The claim type (name) used to identify whether or not a user is an administrator. For group membership in Azure AD, use ‘groups’ and be sure that “groupMembershipClaims” is set to “Security Group” or “1” in the app registration manifest in Azure.
8. Authorized User Claim Value – * A regular expression used to test the value reported by the OIDC Admin User Claim. If blank, the claim value will be tested for true/false (assume false). If non-blank, the claim value will be tested to see if it is a match of this regular expression. If using ‘groups’ claim type in Azure AD, use the object id of the group (guid with dashes).
9. Admin User Claim Type – The claim type (name) used to identify whether or not a user is an administrator. For group membership in Azure AD, use ‘groups’ and be sure that “groupMemebershipClaims” is set to “SecurityGroup” or “1” in the app registration manifest in Azure.
10. Admin Users Claim Value – * A regular expression used to test the value reported by the OIDC Admin User Claim. If blank, the claim value will be tested for true/false (assume false). If non-blank, the claim will be tested to see if it is a match of this regular expression. If using ‘groups’ claim type in Azure AD, use the object id of the group (guid with dashes).

11. Keycloak IDP Hint – An identify provider (IDP) that contains a hint with signing key ID.