Admin: Appendix B - Open ID Connect (OIDC) configuration

Overview

This section provides instructions on setting up RPI to make use of an OIDC provider for authentication. The following RPI application settings are utilized for this purpose:

Name	Description
Authentication__OpenIdProviders__0__Name	Name of provider as displayed in RPI Sign In dialog.
Authentication__OpenIdProviders__0__Audience	The Audience ID configured within the OpenId provider.
Authentication__OpenIdProviders__0__AuthorizationHost	The authorization host for the configured OpenId provider. The user will be taken to this page when logging into RPI using the OpenId authentication.
Authentication__OpenIdProviders__0__ClientID	The Client Id configured within the OpenId provider.
Authentication__OpenIdProviders__0__CustomScopes	List of custom scopes required to request the OpenId access token.
Authentication__OpenIdProviders__0__EnableRefreshTokens	True = enable the option to enable refresh tokens (recommended) False = disable refresh tokens. If refresh token is disabled, the client will be logged off once the token expires, per the period configured within the OpenId provider.
Authentication__OpenIdProviders__0__LogoutIdTokenParameter	Query parameter name used to pass the id token on logout. The default value is id_token_hint.
Authentication__OpenIdProviders__0__RedirectURL	The redirect URL used for retrieving the token, as configured within the OpenId provider.
Authentication__OpenIdProviders__0__ValidateIssuer	true = the AuthorizationHost must match the issuer name supplied in the access token.
Authentication__OpenIdProviders__0__ValidateAudience	true = the OpenIdAudience must match the audience name supplied in the access token.
Authentication__OpenIdProviders__0__SupportsUserManagement	true = RPI supports management of users directly within OIDC provider (as well as native user management).

The following OIDC providers have been validated for use with RPI. Separate sections describe how to configure the aforementioned RPI applications for each.

Keycloak

The steps below assume the Realm has been created and configured within Keycloak. Please refer to the Keycloak documentation (https://www.keycloak.org/docs/latest/getting_started/index.html) for steps on how to create the required components.

• Authentication__OpenIdProviders__0__Audience

  1. Log into the Keycloak portal, under the Realm configured for RPI.

  2. Expand the “Clients” section.

  3. For a typical install, the “account” Client ID is the default name for the audience. Set this value at the Authentication__OpenIdProviders__0__Audience configuration application setting.

• Authentication__OpenIdProviders__0__AuthorizationHost

  1. As Keycloak is self-installed, the Authorization Host will be formatted as follows: https://<fqdm>:<port>/auth/realms/<realm_name>.

  2. Set this value at the Authentication__OpenIdProviders__0__AuthorizationHost configuration setting.

• Authentication__OpenIdProviders__0__ClientID

  1. Open the list of Keycloak Clients and select the client ID configured for RPI.

  2. Copy the value in the “Client ID” text box and set the Authentication__OpenIdProviders__0__ClientID application setting to the same.

• Authentication__OpenIdProviders__0__CustomScopes

  • Custom scopes are not required for this provider, however, the email claim must be configured within the client scope. This feature is enabled by default but can be confirmed by navigating to Client Scopes>Email>Mappers>Email. Ensure the “Add to access token” option is turned on.

• Authentication__OpenIdProviders__0__ RedirectURL

  1. Open the client settings for the Keycloak client configured for RPI.

  2. Under the Settings tab, scroll down to the Valid Redirect URIs configuration setting and select the +@ icon to add a new redirect URI. This must be a valid and accessible URL with the https:// protocol.

  3. Use the same URL at the Authentication__OpenIdProviders__0__ RedirectURL application setting.

  4. Select the Save button once the URI is updated.

Okta

Portal Link

The steps below assume the application has been created within Okta. Please refer to the Okta documentation (https://help.okta.com/en/prod/Content/index.htm) for steps on how to create the required components.

• Authentication__OpenIdProviders__0__Audience

  1. Log into the Okta portal and expand the “Security” section.

  2. Select the “APIs” link.

  3. Under the “Authorization Servers” tab, copy the value in the Audience column and paste the value into the application setting.

• Authentication__OpenIdProviders__0__AuthorizationHost

  1. Open the API configuration screen.

  2. Copy the value in the “Issuer URI” column of the “Authorization Servers” tab and paste the value into the application setting.

• Authentication__OpenIdProviders__0__ClientID

  1. Expand the “Applications” section and select the “Applications” link to view the list of configured applications.

  2. Proceed by selecting the application created for use in RPI.

  3. Under “Client Credentials”, select the copy Client ID button and paste the value into the application setting.

• Authentication__OpenIdProviders__0__CustomScopes

  1. Custom scopes are not required for this provider, however, the email claim must be configured within the Audience, as covered above. To add the email claim, expand the “Security” section and select the “APIs” link. Select on the “Name” link of the Audience to open the configuration. Once in the configuration, select the “Claims” tab and select the “Add Claim” button.

  2. Enter “email” for Name and “appuser.email” for Value.

  3. Select the Save button.

• Authentication__OpenIdProviders__0__ RedirectURL

  1. Open the settings for the RPI Okta application.

  2. Under General Settings, select the Edit link.

  3. Scroll down to the LOGIN section of the settings and enter a URL in the “Sign-in redirect URIs” text box. This must be a valid and accessible URL with the https:// protocol.

  4. Copy the same URL for the “Sign-out redirect URIs” text box as well.

  5. Hit the Save button once complete.

  6. Paste the value into the application setting.

AzureAD

To configure AzureAD for use as an RPI OIDC provider, you will need a valid Azure Tenant ID and App Registration Client ID. Please follow these steps to obtain these.

1. Log into the Microsoft Entra Admin center (https://entra.microsoft.com) and then select the Microsoft Entra ID (Azure AD) tile.

2. From the +Add drop down, choose App registration.

3. Name your registration.

4. Choose the account type.

5. Set the Redirect URI to be Public client/native (Mobile & Desktop)

6. Set the value of the Redirect URI.

7. You’ll be redirected the App Registrations overview page. Select the Add an Application ID URI link.

5. Select the Add link next to Application ID URI.

6. Add a custom scope named Interaction.Clients.

6. Having obtained an Azure Tenant ID and App Registration Client ID, configure application settings in RPI as follows:

   • Red: Azure Tenant ID

   • Green: App Registration Client ID