You can add an OpenID Connect application to enable single sign-on using OIDC-based authentication.
Procedure
-
From the Command Center navigation pane, go to Manage > Account > Security.
The Security page appears.
-
Click the Identity servers tile.
The Identity servers page appears.
-
To create an OpenID connect application for a specific company, in the upper-right corner of the page, from the Select a company list, select the company.
-
Click Add, and then select OpenID connect.
The General page of the Add OpenID Connect app wizard appears.
-
In the Name box, enter a name for the OpenID Connect app.
-
In the Description box, enter a description for the app.
-
Click Next.
The Client Configuration page of the Add OpenID Connect app wizard appears.
-
In the Client ID box, enter the unique identifier of your application (created at OIDC provider) that you want to use for authentication.
-
In the Client secret box, enter the private key that is shared between your application and the OIDC provider.
-
In the Discovery endpoint URL box, enter the URL provided by the OIDC provider.
For example, the Discovery endpoint URL could be:
https://oidc-provider.com/.well-known/openid-configuration -
Click Next.
The Associations page of the Add OpenID Connect app wizard appears.
-
To authenticate users using the OpenID application, associate users with the application using any of the following methods:
-
To authenticate users of a specific company with an OpenID Connect app, on the Companies tab, from the Select company list, select the company, and then click Add.
-
To authenticate users of a specific domain with an OpenID Connect app, on the Domains tab, from the Select domain list, select the domain, and then click Add.
-
To authenticate users of a specific user group with an OpenID Connect app, on the User groups tab, from the Select user group list, select the user group, and then click Add.
Note
-
Automatic redirection to the IdP is not supported for new users. Only existing users who are associated with the OpenID application through user groups, domains, or companies will be redirected to the IdP.
-
Users can be created manually on an individual basis or imported in bulk.
-
-
Click Submit.