The "OAuth Authentication Settings" menu is where OAuth authentication to the LMS can be configured. The OAuth Access Token URL is required for Mobile App authentication with the "Kubernetes" micro-service architecture.
Description
|
Setting |
What does the setting do? |
|---|---|
|
OAuth - Access Token URL (e.g. https://lms.company.com/idm/oauth/token) (500 characters max.) |
|
|
Access token expiry time |
Time to live in seconds of the access token generated by OAuth. |
|
Refresh token expiry time |
Time to live in seconds of the refresh token generated by OAuth. Default value -1 means that the refresh token does not expire. Possible value: between -1 and 2147483. |
|
Access token caching time |
Time to live in seconds of the access token generated by OAuth in cache. |
OAuth Identity provider
|
Setting |
What does the setting do? |
|---|---|
|
OAuth Provider ID (2000 characters max.) |
|
|
OAuth Authorization endpoint (2000 characters max.) |
|
|
OAuth Token endpoint (2000 characters max.) |
|
|
OAuth User info endpoint (2000 characters max.) |
|
|
OAuth Response Type (2000 characters max.) |
|
|
OAuth Scope (2000 characters max.) |
|
|
OAuth Claim ID (2000 characters max.) |
|
|
ILS Person attribute (30 characters max.) |
|
|
Send params as request Body |
|
|
Use User Endpoint Introspection |
|
OAuth Client application
|
Setting |
What does the setting do? |
|---|---|
|
OAuth Provider ID (2000 characters max.) |
|
|
Default client for OAuth |
|
|
Activate account provisioning for OAuth |
|
|
ILS Client ID (2000 characters max.) |
|
|
OAuth Client app ID (2000 characters max.) |
|
|
OAuth Client app secret (2000 characters max.) |
|
|
Redirect URI (LMS) (2000 characters max.) |
|
OAuth Client mapping
Settings
|
Setting |
What does the setting do? |
|---|---|
|
Client |
Client that the mapping relates to. |
|
Default |
This setting enables one client mapping to be defined as the ‘Default client’. The one mapping entry set as Default will be automatically taken if no other OIDC mapping configuration is found by matching URL parameters against the client configuration. In the ‘Client’ configuration it can be defined how the system will match which client is to be used after first contact; this normally happens via url parameters such as client=external. With that information, the SSO process will check the OIDC configuration for a matching client; if it does not find one and there is no default there would be an error, but if there is a ‘Default’ this mapping will be used and there will be no error. |
|
OAuth Person identifier |
Attribute used to map the user in the source to the LMS. |
|
Update existing OAuth user |
If the value is set to ticked/true, persons that already exists will be updated with the attributes found from the OIDC response. |
|
Reference |
Determines whether all source fields specified by mapping elements will be expected and imported in the imported file. TRUE: The mapping elements determine which fields will be imported. Additional attribute entries found in the import file will be ignored. FALSE: Only the attribute entries found in the import file will be imported. Additional attributes specified by mapping elements will be ignored. |
OAuth Mapping entries
|
Setting |
What does the setting do? |
|---|---|
|
Source field |
Name of the source field. |
|
Target field |
Name of the assigned target attribute in the LMS user profile. |
|
Hash Identifier |
Identifier for the hash table element that is defined within the personImport/rules element. Note: If this optional element is specified, the referenced hash table will be used to define the value of the target field (clixField) from the value of the source field. |
|
Ignore empty field |
Determines if empty identifier values of personal profiles are carried over to LMS during import. False/Unticked: Empty personal-profile identifier values are carried over to LMS. True/Ticked: Empty personal-profile identifier values are not carried over to the LMS |