OpenID Connect method Configuration UI is available in Ubisecure SSO 8.8.x and later

Introduction

This article is intended to be step-by-step guide on how to create a new OpenID Connect (OIDC) authentication method.

Before you begin please refer your external OIDC Identity Provider's documentation on how to configure and setup new applications. In this scenario, Ubisecure SSO will act as an OpenID Connect Relying Party where as the external Identity Provider will act as an OpenID Connect Provider. One of the key information you need before creating an OIDC method to Ubisecure SSO is that you must have access to the OpenID Provider metadata and JSON Web Key Set (JWKS) of the external Identity Provider. You will need these in steps 4 and 5.

Configuring a new OpenID Connect authentication method

Create OIDC authentication method to Ubisecure SSO

Click New Method... at Global Method Settings tab.
Add title, name and select OpenID Connect as Method Type. Then press OK.
Go to OpenID Connect tab.
Upload Authentication Provider metadata by pressing Upload... at Provider Metadata area.
Upload Authentication Provider JWKS by pressing Upload... at Provider JWKS area
Press Update

Get registration request for external IDP

Registration request and response

In order to configure Ubisecure SSO as OpenID Relying Party in your external OpenID Identity Provider you need information, such as redirect URIs, signing and encryption keys, algorithms and etc., to be configured in the external Identity Provider. For this Ubisecure SSO provides a way to generate a standard OpenID client metadata. The following steps will guide you thought this process.

When you have registered Ubisecure SSO as OpenID Relying Party to the external Identity Provider you either get back a registration response or you need to create it yourself. If the external Identity provider does not provide a standard response you can use the registration request as a baseline and fill in the missing details such as the client ID that is expected by the external Identity Provider.

You may need to modify some additional registration response parameters to make Ubisecure SSO to work with the external IDP. Please refer to OpenID Connect Authentication method - SSO for more details.

Obtaining OpenID Connect Provider metadata

If your OpenID Provider supports the OpenID Connect Discovery specification, you can obtain the OP configuration metadata using a well-known endpoint similar to HTTP GET /.well-known/openid-configuration

In Ubisecure SSO

Press Create to create Registration Request
Send Registration Request to Authentication Provider
Upload Registration Response

Complete authentication method configuration

Press Update
Go to Main tab
Check Enabled
Press Update

Browser not supported