Configure OpenID Connect in Omnissa Access for your third-party identity provider to allow users to use their credentials for single sign-on.
Prerequisites
-
Make sure that Omnissa Access is registered as an OAuth2 client or as an OAuth2 application on the third-party identity provider.
- The authorization_code grant must be enabled.
- The redirect_uri is set to the Omnissa Access callback endpoint.
This registration generates the client ID name and client secret. These values are required when you configure the third-party identity provider in the Omnissa Access console. Refer to the identity provider documentation about how to register the OAuth2 clients and applications.
-
Know the URL of the identity provider's well-known published OpenID Connect address if you are using auto discovery to configure OpenID Connect endpoints.
-
Know the URLs for the OpenID Connect authorization endpoint, token endpoint, issuer identifier, and JWKS URL of the authorization server's public key if you are using the manual configuration process.
-
If you enable Just-In-Time provisioning, identify the domains from where users are coming from. The domain name displays in the drop-down menu in the log in page. If more than one domain is configured, the domain information must be in the token that is sent to Omnissa Access.
Procedure
-
In the Omnissa Access console Integrations > Identity Providers page, click ADD and select OpenID Connect IDP.
-
Configure the following settings.
Form Item Description Identity Provider Name Enter a friendly name for this OpenID Connect identity provider instance. Authentication Configuration Select Automatic Discovery if the identity provider offers the capability to use the well-known published OpenID Connect URL to get the OpenID Connect endpoint configuration URLs. Enter the URL as https://{oauth-provider-hostname}/{local-oauth-api-path}/.well-known/openid-configuration.
Select Manual Configuration to add the OpenID Connect URL endpoint manually, if using Auto Discovery is not possible or contains incorrect information.
The following endpoint URLs are configured with Auto Discovery. For Manual Configuration, add the URLs for each of the endpoints.- Authorization Endpoint URL where to obtain the authorization code, using the authorization code grant.
- Token endpoint URL is used to obtain access tokens and refresh tokens.
- Issuer Identifier URL is the URL of the entity that issues a set of claims.
- JWKS URL. is the URL of the authorization server's public key in the JSON Web Key Set (JWKS) format.
Client Details - Client ID. The identity provider-generated Client ID that is the unique identifier for Omnissa Access.
- Client Secret. The client secret generated by the OpenID Connect identity provider. This secret is known only to the identity provider and the Omnissa Access service.
If this client secret is changed on the identity provider server, make sure you update the client secret in the Omnissa Access server.
User Lookup Attribute In the Open ID User Identifier Attribute column, select the user attribute in the identity provider services to map to Omnissa Access User Identifier Attribute. The mapped attribute values are used to look up the user account in the Omnissa Access service.
You can add a custom third-party attribute and map it to a user attribute value in the Omnissa Access service.Just-in-Time User Provisioning When Just-in-Time provisioning is enabled, users are created in Omnissa Access and updated dynamically when they log in, based on the token sent by the identity provider.
When you enable Just-in-Time, create the Just-in-Time directory.- Directory Name. Enter the JIT directory name where user accounts are added.
- Domains. Enter the domains that authenticated users belong to. If more than one domain is configured, the domain information must be in the token that is sent to Omnissa Access.
- Map the User Attributes. Click + ADD to map OpenID claims to the Omnissa Access attributes. These values are added when the user account is created in the Omnissa Access directory.
Users If you do not enable JIT provisioning, select the directories that include the users who can authenticate using this identity provider. Network The existing network ranges configured in the service are listed. Select the network ranges for the users based on their IP addresses, that you want to direct to this identity provider instance for authentication. Authentication Method In the Authentication Method Name text box, enter a name to identify the third-party OpenID Connect authentication method in the access policy. When you create the access policy rules, you select this authentication method to redirect users to authenticate against the OpenID Connect authorization server.
In the Authentication Method Description text box, write a description of authentication method to help users choose this authentication method. The text in the Description text box is displayed in the Select Authentication login prompt page when this third-party identity provider authentication method is an authentication choice option in an access policy rule. See Set Up Choice of Authentication Access Policy Rules.
This text is not automatically translated to languages specified by the end user's browser. However, you can compose the content in multiple languages as a single entry in the Description text box which displays under the authentication method on the login prompt page.Pass through Claims Enable pass through claims to support the use of non-standard OpenID Connect claims. The third-party OpenID Connect identity provider sends the non-standard claims to Omnissa Access. Omnissa Access adds these claims to the token that is generated. Redirect URI The redirect URI is where the response to the request is sent after the user signs in. The URI is listed. -
Click SAVE.
What to do next
In the console, go to the Resources > Policies page and edit the default access policy to add a policy rule to select the OpenID Connect authentication method name as the authentication method to use.
Was this page helpful?