Page History

...

1. If you have not already done so,   register register User Administration with your OpenID Connect identity provider.  You can get the values for the attributes used in the oidc.json file from the authorization server (Keycloak, connect2id, etc.and so on).

2. Register the necessary redirect URIs so that the OIDC server knows where to send the user after authentication. The <pstsec>/pstsec/login/oauth2/code/dtp URI should be registered.

...

...

• Keycloak should be using RS256 as the default signature algorithm.
• The access token from Keycloak should include user information available that can also be retrieved from the Keycloak userinfo API endpoint.
• The following redirect URIs should be registered:
  
  • host<HOST>:port<PORT>/* (default windows port is 80, linux port is 8080)
  • host<HOST>:8314/*
  • host<HOST>:8082/* (for Data Collector upload form) 
  If wildcards are not used, then individual URIs for Report Center, User Administration, License Administration need to be added. See OIDC Server Configuration for additional information about registering redirect URIs.

In this example, demo is is the name of the realm, and two administrator users (admin1 and admin2) will be created.

"enabled": true,
"issuerUri": "https://host:8095/auth/realms/demo/",
"clientId": "pstsec",
"clientSecret": "4d35ef23-aec5-44d7-9c59-18092bd619e8",
"scopes": ["openedopenid","profile","email"],
"claimMappings":
	{ 
		"username": "preferred_name", 
		"firstName": "given_name", 
		"lastName": "family_name", 
		"email": "email" 
	}
"adminUsers": ["admin1","admin2"]

...

"enabled": true,
"issuerUri": "https://accounts.google.com",
"clientId": "<clientId-from-google>",
"clientSecret": "<clientSecret-from-google>",
"scopes": ["openedopenid","profile","email"],
"claimMappings":
	{ 
		"username": "given_name", 
		"firstName": "given_name", 
		"lastName": "family_name", 
		"email": "email" 
	}
"adminUsers": ["admin1","admin2"] 

...

The following example demonstrates how to configure OpenID Connect for connect2id. Users must access User Administration  over over HTTPS when using connect2id as the OpenID Connect provider.In this example, c2id is the name of the realm. Two administrator users (admin1 and admin2) will be created. 

"enabled": true,
"issuerUri": "https://host:port/c2id",
"clientId": "<clientId-from-c2id>",
"clientSecret": "<clientSecret-from-c2id>",
"scopes": ["openedopenid","profile","email"],
"claimMappings":
	{ 
		"username": "sub", 
		"firstName": "given_name", 
		"lastName": "family_name", 
		"email": "email" 
	}
"adminUsers": ["admin1","admin2"] 

...

As a prerequisite, you must configure authentication for the Azure app to allow the following web redirect URIs:

• https://<DTP host and port>_HOST>:<PORT>/grs/login/oauth2/code/dtp
• https://<DTP host and port>_HOST>:<PORT>/licenseserver/login/oauth2/code/dtp
• https://<DTP host and port>_HOST>:<PORT>/pst/login/oauth2/code/dtp
• https://<DTP host and port>_HOST>:<PORT>/pstsec/login/oauth2/code/dtp

The port is not required if the host uses the default HTTPS port 443.

The following example demonstrates how to configure OpenID Connect for Azure. In this example, two administrator users ([email protected] and johnand john[email protected]) will be created.

{
    "enabled": true,
    "issuerUri": "https://login.microsoftonline.com/<tenantId>/v2.0",
    "clientId": "<clientId-from-Azure>",
    "clientSecret": "<clientSecret-from-Azure>",
    "scopes": ["openid", "profile", "email"],
    "claimMappings": {
        "username": "email",
        "firstName": "given_name",
        "lastName": "family_name",
        "email": "email"
    },
    "adminUsers": [
        "[email protected]",
        "[email protected]"
    ]
} 

The claimMappings uses fields from the response to https://graph.microsoft.com/oidc/userinfo, which contains a limited set of fields.  The following contains an example response for the user with the email address [email protected].

{
  "sub": "<unique value for user>",
  "name": "Jane Jones",
  "given_name": "Jane",
  "family_name": "Jones",
  "picture": "https://graph.microsoft.com/v1.0/me/photo/$value",
  "email": "[email protected]"
} 

...

You must pass the token for every API call, regardless of the method. In the following example, a token with the value "1234567890" is  is passed to the DTP build API endpoint.

...