OIDC Authentication

OpenID Connect (OIDC) authentication can be used to provide User authentication for the 1Integrate UI.

     Note: Currently, only the Keycloak OIDC provider is supported.

     Warning: The REST API will still use the standard fixed user list or LDAP authentication.

Key information:

  • Only one OIDC provider can be configured at a time.

  • Access groups will not work when OIDC authentication is enabled.

  • Only the Keycloak OIDC provider is supported.

  • Whilst enabled, OIDC will be the only method available for accessing the 1Integrate UI.

Configuring OIDC

The following steps will need to be followed for OIDC to work.

  1. Configure your OIDC provider .

         Note: The role names on the Configuring Users and Permissions page will need mapping to those within your OIDC provider.

  2. Next, add INTEGRATE_OIDC_ENABLED=true as either an environment variable (to persist between installations) or in the start-Interface.cmd (Windows) /start-Interface.sh (Linux) start-up scripts.

  3. Ensure you have set the authentication.oidc.provider_url (this is the minumum required setting) in the settings.properties file. For further details on other parameters, see the table below.

  4. Users will now be able to log-in using OIDC authentication, after which they can use 1Integrate.

Configurable OIDC Parameters in settings.properties

Property

Type

Description

authentication.
oidc.provider_url

string

The URL for your OIDC provider.

      Note: Only the Keycloak OIDC provider is supported.

      Note: If you set authentication.oidc.provider_url to the wrong provider or to an invalid URL, 1Integrate will still start but users will see a Forbidden page.

authentication.
oidc.ssl_required

enum

Set to have the OpenID provider communicate over HTTPS. Valid options are:

  • "all" - Always require HTTPS

  • "external" - Only require HTTPS with external requests

  • "none"- HTTPS is not required

      Note: This option defaults to "external". It is recommended that you set to "all" in production environments

authentication.oidc.
principal_attribute

string

Set the claim value from the ID token. This will be used as the principal for the identity.

Defaults to preferred_username.

authentication.
oidc.client_id

string

The Client ID. This value will need to match the Cient ID in your OIDC Provider.

Defaults to 1integrate.

authentication.
oidc.public_client

boolean

Default to true, where client credentials are not sent when communicating with the OpenID provider.