Single Sign On (OIDC)

auth.oidc.rp.client.id

Default value ""

Client ID provided by Identity Provider. If it is not present, the SSO functionality is disabled.

auth.oidc.rp.provider.url

Default value ""

Provide the Base URL to the associated Identity Provider. This URL, concatenated with `/.well-known/openid-configuration`, must retrieve the OpenID Provider's configuration as per the OpenID Connect Discovery specification.

Example: https://login.microsoftonline.com/<tenant_ID>/v2.0

auth.oidc.rp.provider.name

Default value ""

The name of the provider needs to be Azure if it is used and groups are returned as uids.

auth.oidc.rp.groupPath

Default value "roles"

Path in ID Token or UserInfo object to find an array of users Access groups as defined by the Access Controller, separated with a dot (.).
The groups should be an array of Strings.
Example:
Here the groups array is inside and object.
{ myObject : { myGroups : [ "myGroup1", "mygroup2" ] } }
The path should then be:
groupPath: myObject.myGroups
When the group's array is direct under UserInfo then groupPath is just the name of the group's array.

auth.oidc.rp.auth.method

Default value "CLIENT_SECRET_BASIC"

Available authentication methods are CLIENT_SECRET_BASIC and PRIVATE_KEY_JWT

auth.oidc.rp.client.secret

Default value ""

This property sets the relevant Client Secret. Needs to be encrypted.

Desktop

<protocol>://<hostname>:<ui-webserver-port>/desktop/sso

Example:
https://server1.digitalroute.com:9001/desktop/sso

Legacy Desktop

<protocol>://<hostname>:<platform-webserver-port>/launch/api/desktop/v1/sso

Example:
https://server1.digitalroute.com:9000/launch/api/desktop/v1/sso

auth.oidc.rp.auth.jwt.keystorePath

Default value ""

Path to JKS keystore when PRIVATE_KEY_JWT is used

auth.oidc.rp.auth.jwt.alias

Default value ""

Alias for key in keystore when PRIVATE_KEY_JWT is used

auth.oidc.rp.auth.jwt.keystorePassword

Default value ""

Keystore password when PRIVATE_KEY_JWT is used, needs to be Encrypted by MediationZone.

auth.oidc.rp.auth.jwt.keyPassword

Default value ""

Key password when PRIVATE_KEY_JWT is used, needs to be Encrypted by MediationZone.

auth.oidc.rp.scopes

Default value ""

Optional additional scopes. Default scopes are openid, profile, and email.

auth.oidc.rp.claims.username

Default value ""

Claim to use as the user name, if not specify sub will be used. This value should be unique. 

auth.oidc.rp.auth.jwt.keyId

Default value ""

Optional Key ID for JWT header when PRIVATE_KEY_JWT is used

auth.oidc.rp.group.syncDisabled

Default value false.

When the value is set to true, the group synchronization from the Identity Provider is disabled, and the groups are set manually on each SSO User.

auth.oidc.rp.group.default

Default value ""

When Group Sync is disabled, the value of this property will be assigned to the user's default group when the user logs in for the first time.

auth.oidc.rp.multigroupsync.defaultGroup

Default value ""

This property assigns a default group to the user who is a member of multiple groups when the user logs in for the first time. It takes effect only when the group synchronization is enabled. The default group can be changed after logging in and must be one of the member groups. Changes made to the default group after logging in will persist in the next login.

auth.oidc.rp.auth.debug

Default value false.

Set this to true during the implementation of SSO Access to get more information.