OIDC config parameters

This article provides detailed information on OIDC configuration parameters.

Applications

You can configure the GenericOidcLogin for multiple Grassfish applications, such as the IXM Platform or MobileApp.

Each application uses its own login URL: https://server/path/to/GenericOidcLogin/{APPLICATIONKEY}/login

Examples: https://server/GenericOidcLogin/CMS/login or https://server/GenericOidcLogin/MobileApp/login

• Application:{APPLICATIONKEY}:LoginSuccessRedirectUrl Required
  Default: string.Empty
  The user is redirected to this URL when the login was successful. The URL needs to contain the @@sh@@ placeholder.
  Example: https://<IXM-Platform-URL>/gv2/gf/GFWebHtml/cms/index.html#/external?lang=en&amp;cid=@@customerId@@&amp;autologin=bysession&amp;sh=@@sh@@&amp;userID=@@userId@@&amp;customerName=@@customerName@@

• Application:{APPLICATIONKEY}:LoginFailedRedirectUrl Optional
  Default: /LoginFailed
  The user is redirected to this URL if the login failed.
  The query parameter error provides the error code of the error that caused the failed login. The following default OIDC error codes are possible: access_denied, login_failed, general_error
  The query parameter error_description provides a description of what caused failed login.

  For example: /LoginFailed?error=access_denied&error_description=User not found

Customer settings

You must set either CustomerCode or Claims.CustomerCode. The application doesn’t start if both or neither are set.

• CustomerCode Optional
  Default: string.Empty

  Constant CustomerCode value for all logins (Single Customer Setup).

• Claims.CustomerCode Optional
  Default: string.Empty
  CustomerCode will be read from this claim (Multi Customer Setup).

User settings

You must set either Claims.ExternalUserId or GrassfishCustomUserIdAttribute. The application doesn’t start if both or neither are set.

• CreateUserIfNotExists Optional
  Default: false
  If this is set to true, a new user is created if no existing user can be found.

• Claims.ExternalUserId Optional
  Default: sub
  The claim that contains the external user ID.

• GrassfishCustomUserIdAttribute Optional
  Default: string.Empty
  Instead of the user name, a custom user property can be used to identify the Grassfish user. Note that CreateUserIfNotExists doesn’t work in combination with this setting.

• Claims.Email Optional
  Default: string.Empty
  The claim that contains the user's email.

• Claims.FirstName Optional
  Default: string.Empty
  The claim that contains the user's first name.

• Claims.LastName Optional
  Default: string.Empty
  The claim that contains the user's last name.

Permission group settings

You must set either Claims.PermissionGroup or DefaultPermissionGroup if CreateUserIfNotExists is true. The application doesn’t start if both are set.

• UpdatePermissionGroupForExistingUsers Optional
  Default: false
  If this is set to true, the permission group is set at every login.

• Claims.PermissionGroup Optional
  Default: string.Empty
  The claim that contains the permission group name.

• DefaultPermissionGroup Optional
  Default: string.Empty
  A constant permission group name that is assigned to all new users.

User group settings

You must set either Claims.UserGroups or DefaultUserGroup if CreateUserIfNotExists is true. The application doesn’t start if both are set.

• UpdateUserGroupsForExistingUsers Optional
  Default: false
  If this is set to true, the user groups are synced at every login.

• Claims.UserGroups Optional
  Default: string.Empty
  The claim that contains at least one user group name.

• DefaultUserGroup Optional
  Default: string.Empty
  A constant user group name that is assigned to all new users.

• UserGroupDelimiter Optional
  Default: string.Empty
  Multiple user group names can be provided in either DefaultUserGroup or Claims.UserGroups. They must be separated by the UserGroupDelimiter.

OpenID connect settings

• OpenId:ConfigurationEndpoint Required
  Default: string.Empty
  Configuration file of the OpenID provider, for example: https://openidprovider/.well-known/openid-configuration

• OpenId:ClientId Required
  Default: string.Empty
  Client identifier valid with the identity provider.

• OpenId:ClientSecret Required
  Default: string.Empty
  Client secret valid with the identity provider.

• OpenId:Scope Optional
  Default: openid profile
  OpenID connect requests must contain the openid scope value. If not, the behavior is entirely unspecified. Other scope values may be present.

• OpenId:ResponseType Optional
  Default: code
  OAuth 2.0 response type value that determines the authorization processing flow to use, including what parameters the endpoints return.

• OpenId:UseUserInfoEndpoint Optional
  Default: false
  Usually the IdToken returned by the TokenEndpoint contains all necessary claims for the login. If that’s not the case, an additional request must be made to load the full user information from the UserInfoEndpoint.

Validation settings

• Validation:ValidAudience Required
  Default: string.Empty
  Represents a valid audience used to check against the token's audience. It’s usually identical to the ClientId.

For more additional validation settings, go to: https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters

Log settings

• LogOpenIdProviderCommunication Optional
  Default: false
  Logs the requests sent to the OpenID provider. This should only be used for troubleshooting as the requests may contain sensitive information.