The 'OpenID Configuration' menu is where interfaces for OpenID Connect authentication and provisioning are configured. Each interface consists of two linked parts, an Identity Provider configuration and a Client Application configuration, connected through a shared Provider ID. OpenID Connect can be configured per client, meaning multiple interfaces can be defined. In addition to the configuration made here, the 'OpenID Connect' checkbox must also be ticked on the 'Access and security' tab of the corresponding Client.
Description
|
Setting |
What does the setting do? |
|---|---|
|
Enable OpenID |
Enables this OpenID Connect configuration so users can authenticate through the configured identity provider. If disabled, this configuration is not used for login. |
|
Use PKCE |
|
|
Request expiry time |
|
|
OIDC Profile Identifier Attribute |
Database name of the Scheer IMC attribute in the PERSON table that will be used to identify a user during OIDC account provisioning. |
Identity Provider
|
Setting |
What does the setting do? |
|---|---|
|
Provider ID (2000 characters max.) |
|
|
Authorization endpoint (2000 characters max.) |
The URL where the client directs the End-User to authenticate and grant authorization to access protected resources |
|
Token endpoint (2000 characters max.) |
|
|
User info endpoint (2000 characters max.) |
|
|
Response Type (2000 characters max.) |
Specifies the type of response the client expects from the authorization server after the authentication process. |
|
Scope (2000 characters max.) |
Defines the permissions or resources the client is requesting from the authorization server. |
|
Response mode (2000 characters max.) |
|
|
Prompt (100 characters max.) |
|
|
Validation issuer (2000 characters max.) |
|
|
JSON webkey set URL (2000 characters max.) |
|
|
Discovery URL (2000 characters max.) |
|
|
Claim ID (2000 characters max.) |
|
|
Claim Value Id (2000 characters max.) |
|
|
Person attribute (30 characters max.) |
the unique attribute, for example Email, used for Client Mapping to link incoming authentication data to an existing LMS user record. |
|
Send Parameter „id_token_hint“ on logout |
|
Client application
|
Setting |
What does the setting do? |
|---|---|
|
Provider ID (2000 characters max.) |
Unique identifier that must match the one referenced in the Client Application section. |
|
Default client |
|
|
Enable account provisioning |
|
|
Client ID (2000 characters max.) |
Unique identifier for your system, the Relying Party, within the identity provider, the OpenID Provider. |
|
Client name (2000 characters max.) |
|
|
Client app ID (2000 characters max.) |
|
|
Client app secret (2000 characters max.) |
|
|
Policy (2000 characters max.) |
|
|
Redirect URI (2000 characters max.) |
The URL the identity provider sends the ID token and authentication result to. |
|
Allowed entry points (2000 characters max.) |
|
Client mapping
Settings
|
Setting |
What does the setting do? |
|---|---|
|
Client |
Client that the mapping relates to. |
|
Default |
This setting enables one client mapping to be defined as the ‘Default client’. The one mapping entry set as Default will be automatically taken if no other OIDC mapping configuration is found by matching URL parameters against the client configuration. In the ‘Client’ configuration it can be defined how the system will match which client is to be used after first contact; this normally happens via url parameters such as client=external. With that information, the SSO process will check the OIDC configuration for a matching client; if it does not find one and there is no default there would be an error, but if there is a ‘Default’ this mapping will be used and there will be no error. |
|
Person identifier |
Attribute used to map the user in the source to the LMS. |
|
Update existing user |
If the value is set to ticked/true, persons that already exists will be updated with the attributes found from the OIDC response. |
|
Import without self-registration |
If the value is ticked/true, persons are automatically created and no self registration page will be presented. |
|
Reference |
Determines whether all source fields specified by mapping elements will be expected and imported in the imported file. TRUE: The mapping elements determine which fields will be imported. Additional attribute entries found in the import file will be ignored. FALSE: Only the attribute entries found in the import file will be imported. Additional attributes specified by mapping elements will be ignored. |
Mapping entires
|
Setting |
What does the setting do? |
|---|---|
|
Source field |
Name of the source field. |
|
Target field |
Name of the assigned target attribute in the LMS user profile. |
|
Hash Identifier |
Identifier for the hash table element that is defined within the personImport/rules element. Note: If this optional element is specified, the referenced hash table will be used to define the value of the target field (clixField) from the value of the source field. |
|
Ignore empty field |
Determines if empty identifier values of personal profiles are carried over to LMS during import. False/Unticked: Empty personal-profile identifier values are carried over to LMS. True/Ticked: Empty personal-profile identifier values are not carried over to the LMS |