What is OpenID Connect?
OpenID Connect (OIDC) is an authentication layer on top of OAuth 2.0. The specification can be found here. The inSided Community OpenID Connect scheme supports Authorization Code Flow.
OpenID Connect flow representation
In order to understand how the OpenID Connect process integrates into the overall Community SSO architecture (i.e. Steps #1-3 in the diagram below) please see Single Sign-on (SSO): Getting Started.
-
Community redirects User to the Authorization URL with GET by attaching Redirect Uri and Client ID.
-
Server authenticates the User and obtains consent/authorization.
-
Server sends the User back to the Community Redirect Uri by attaching Authorization Code.
-
Community requests a response with ID Token and Access Token in JSON format at the Token URL with POST(application/x-www-form-urlencoded) by attaching Authorization Code, Client ID, Redirect Uri and Client Secret as parameters.
-
Community receives a response that contains an ID Token and Access Token in the response body.
-
Community validates the ID Token and retrieves the user subject identifier or sub (later id).
-
If User Info URL is configured Community requests a response with Profile data in JSON format at the User Info URL with GET by attaching Access Token as Authorization Bearer header.
After retrieving the minimal required id or more complete Profile data, Community starts #Step 3 of Community Single Sign-on.
Redirect Uri is generated by Community automatically
How to Configure OpenID Connect on inSided
Server
Set up an OpenID Connect compatible Server with the following endpoints:
- Authorization Endpoint
- Access Token Endpoint
- (Optional) User Info Endpoint
Community (inSided) configuration
- Log in to Control as an Administrator
- Go to Integrations > SSO > Open ID
- Fill in the following fields:
- Authorization URL*
- Client ID*
- Client Secret*
- Issuer*
- Token Url*
- Scope
- User Info Url
* Indicates required fields
- Press Install
Once you’ve installed your configuration, we recommend using the built-in inSided SSO testing tool before you enable SSO for end users, to make sure everything is working as expected.
