OpenID Connect (OIDC)

You can configure OpenID Connect on Unified Access Gateway to allow end users to authenticate through an IDP using Open ID Connect protocol.

Prerequisites

• Ensure that the OIDC Provider (IDP) configuration URL is up and running before configuring Unified Access Gateway.
• Ensure that the OIDC endpoints are always reachable from Unified Access Gateway as every auth request involves communication between Unified Access Gateway and IDP.
• Unified Access Gateway details must be registered with the OIDC Provider and obtain the Client ID and Secret.
• OIDC Provider certificate information must be available if it is not issued by a trusted CA.
• If a Load Balancer exists, it must be configured to send the same inbound host name to Unified Access Gateway through X-Forwarded-Host header.

Procedure

1. In the Configure Manually section of the admin UI, click Select.

2. In the General Settings, toggle the button to show the Authentication Settings.

3. Click the OpenID Connect gearbox icon.

4. In the OpenID Connect window, click Add.

5. Configure the OpenID Connect options and save this configuration.

   Option	Action
   Configuration ID	Enter a unique configuration ID for the OIDC setting. This will be referred when OIDC is configured as preferred authentication method.
   Configuration URL	Enter the configuration URL obtained from the OpenID provider. Example: https://auth.example.com/.well-known/openid-configuration
   Client ID	Enter a unique client ID from the OpenID provider after the client is registered.
   Client Secret	Enter the secret code associated with the client ID from the OpenID provider.
   Always force OIDC Auth	Turn on this toggle to enforce OIDC provider to re-authenticate the user when trying to connect to UAG even when an authenticated session already exists on the OpenID Connect provider.
   Trusted Certificates	Note: If the Configuration URL is hosted with a certificate that is not a CA signed certificate, you can upload a trusted certificate or add a thumbprint. To select a certificate in PEM format and add to the trust store, click +. To provide a different name, edit the alias text box. By default, the alias name is the filename of the PEM certificate. To remove a certificate from the trust store, click -.
   Configuration URL Thumbprint	Note: If the Configuration URL is hosted with a certificate that is not a CA signed certificate, you can upload a trusted certificate or add a thumbprint. When Server Certificate is trusted based on thumbprint, hostname verification and validity check for the certificate is skipped. Enter the list of acceptable TLS server certificate thumbprints for the configuration URL in the following format: [alg]=xx:xx..... alg - sha1, sha256 (default), sha384, or sha512 xx - hexadecimal digits : - is a separator Example: sha1=C3 89 A2 19 DC 7A 48 2B 85 1C 81 EC 5E 8F 6A 3C 33 F2 95 C3, sha256=ad:5c:f1:48:47:94:7e:80:82:73:13:6c:83:52:b:e:78:ed:ff:50:23:56:a8:42:8a:d9:30:fc:3a:33:d6:c6:db, sha512=2221B24DC78018A8FAFF81B7AD348722390793DE8C0E5E5AA1D622BCC951D4DA5DBB1C76C79A258A7AFBD1727447151C90E1733E7E83A7D1D46ADF1A31C7849
   Server Timeout in Seconds	Enter the timeout in seconds (min 1 sec, max 120 sec) to communicate with the OIDC provider. By default, the timeout value is set to 60 seconds.