Neurons for ITSM OpenID Connect Configuration

the openid connect (oidc) configuration is based on the identityserver3 library the steps to enable the oidc are as follows adding the necessary metadata (new business objects in configdb and tenantdbs) updating appserver web config settings adding a token signing certificate to configdb adding an oidc client record to configdb for the client application adding metadata the oidc requires new business objects to be added to configdb and tenantdbs, which will be included in the 2019 1 out of the box databases and upgrade packages however, they are also available in the following standalone packages in the git sm upgradepackagefiles repository openidconnect/openidconnect configdb metadatapatch openidconnect/openidconnect tenant metadatapatch openidconnect configdb metadatapatch adds the following metadata to configdb oidc client business object and associated workspace oidc claim business object (child object of oidc client) oidc secret business object (child object of oidc client) oidc flow business object and validation list oidc tokenusage business object and validation list oidc tokenexpiration business object and validation list oidc accesstokentype business object and validation list oidc token business object (stores oidc refresh tokens and other token types) "oidctokensign" certificate category (added to frs certificate category validation list) openidconnect/openidconnect tenant metadatapatch adds the following metadata to a tenant db oidc consent business object (stores oidc consent choices made by users) updating web config settings the following appserver web config settings are available \<appsettings> \<add key="enableopenidconnectauthentication" value="true" /> \<add key="oidclegalurl" value=" https //www ivanti com/company/legal " /> \<add key="oidcpatentsurl" value=" https //www ivanti com/company/legal/ivanti patents " /> \<add key="oidchtmlfolder" value="ism" /> \<add key="oidcsitename" value="ivanti cloud" /> \</appsettings> enableopenidconnectauthentication required to enable oidc default value is "false" oidclegalurl optional the legal url link displayed on the oidc login page default value is " https //www ivanti com/company/legal " oidcpatentsurl optional the patents url link displayed on the oidc login page default value is " https //www ivanti com/company/legal/ivanti patents " oidchtmlfolder optional controls the look and feel of the oidc login page etc default is "ism" other options are "uno" and "app" (generic) oidcsitename optional controls the title text displayed on the oidc login page etc default is "ivanti cloud" adding a token signing certificate oidc requires a token signing certificate you can create a self signed certificate using the following command line tools makecert exe r pe n "cn=oidcsign1" b 01/01/2017 e 01/01/2025 sky signature a sha256 len 2048 sv oidcsign1 pvk oidcsign1 cer pvk2pfx exe pvk oidcsign1 pvk spc oidcsign1 cer pfx oidcsign1 pfx po password12 makecert exe will ask you for a private key password you can select "none" the above will result in a oidcsign1 pfx certificate file with a password "password12" add the certificate to the configdb certificates table as shown below the certificate id must be "oidctokensigningcertificate" the certificate category must be "oidctokensign" adding oidc client configuration each oidc client application must have a corresponding oidc client record in configdb that specifies its configuration and maps it to an tenant and corresponding users (usually employee records) the configuration for the "mvc owin hybrid client" example client application is shown in the following screenshot field descriptions are as follows field description enabled specifies if the client record is enabled client name client display name (used for logging and consent screen) client id login id of the employee of the tenant used for generating the jwt token open the employee workspace to get the login id tenant tenant mapping for the client flow specifies allowed flow for client (either authorizationcode, implicit, hybrid, resourceowner, clientcredentials or custom) if you want to generate jwt token using the oidc login api, ensure you select the flow as resourceowner client uri uri to further information about client (used on consent screen) require consent specifies whether a consent screen is required allow remember consent specifies whether user can choose to store consent decisions redirect uris specifies the allowed uris to return tokens or authorization codes to (comma separated list) post logout uris specifies allowed uris to redirect to after logout (comma separated list) logout uri specifies logout uri at client for http based logout (required for single sign out) require sign out prompt specifies if the client will always show a confirmation page for sign out logout session required specifies if the user’s session id should be sent to the logout uri allow access to all scopes / allowed scopes by default a client has no access to any scopes either specify the scopes explicitly here (recommended) or set allowaccesstoallscopes to "true" additional claims can be added to the jwt that's generated using the oidc claim child object some oidc flows (e g hybrid) require a "secret" value that the client must supply secrets are adding using the oidc secret child object only the value field is required the other fields are optional the oidc client business object supports all the identityserver3 client settings the remaining settings are available via the advanced settings form the configuration for the "mvc owin implicit client" example client is as follows implicit flow does not require a secret to set up users for authentication via the , refer to setting up itsm users for authentication via the neurons platform docid\ wnkkhhscs2a4b5njr5ng4 and authentication https //help ivanti com/ht/help/en us/cloud/vnow/authentication htm this feature is early access only and may not be available in your environment for more information, please contact your customer success manager