---
title: Configuration on ICS
slug: ps/help/en_us/ics/com/oauth-dg/configuration-on-ics
docTags: 
createdAt: 2026-08-03T09:43:13.637Z
---

## Create an OAuth Server on ICS using the ICS Admin console

1. Log in to the ICS Admin console as admin and navigate to **Authentication > Auth Servers**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/V1R01Ea3ymxqtmiyX4FXE_configonics.png" size="56" isUploading="false" initialPath="images/config_on_ics.png" githubPath="oauth-dg/images/config_on_ics.png" width="556" height="242" darkWidth="556" darkHeight="242" position="flex-start" showCaption="false" indent="1"}

2. From the dropdown list, select  **OAuth Server** and click **New Server**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/vOq0-yRMw2Zi1CsQPlo9j_image.png" size="40" isUploading="false" width="500" height="606" darkWidth="500" darkHeight="606" position="flex-start" showCaption="false" indent="1"}

3. The **Username Template** field for OAuth servers is now supported, allowing administrators to customize the username displayed to end users in the End User Portal and in User Access logs. Previously, the displayed username was always the email address from the ID Token (if available), or the sub value if not.
   Examples:
   \<email>: Displayed username is "joe\@example.com"
   \<family\_name>, \<given\_name>: Displayed username is "Smith, Joe"
4. The template can include static text as well as variable attributes in the \<attr> format, which are replaced with values from the UserInfo response sent by the OAuth Provider. If an attribute is not found, the \<attr> token will be replaced with an empty string.
5. Provide all the required parameters. Select **Force Authentication** to re-authenticate end users though a valid session is available at OAuth Provider.
6. Select **Enable PKCE** to incorporate the OAuth protocol extension outlined in RFC 7636. Enabling Proof Key for Code Exchange (PKCE) helps to protect against interception of the authorization code returned from the authorization endpoint, by utilising a dynamically created cryptographically random key during the authorization and token requests.
7. Specify the **maximum authentication age** in seconds (0 to 86400). A value of **0&#x20;**&#x70;revents the OIDC max\_age parameter from being sent. The OIDC max\_age parameter is included only when this value is greater than 0.
   Reduces the attack surface and prevents cookie reuse, helping to ensure secure authentication.
8. Select **Manual&#x20;**&#x74;o manually download the OAuth provider metadata from well-known OpenID URL in JSON format and upload to ICS.
9. Select **Dynamic&#x20;**&#x74;o enter the well-known OpenID URL of the OAuth provider. ICS automatically fetches the OAuth Provider metadata from the location.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/cOZ8jHmv9bsaOKVX6XmpU_image.png" size="100" isUploading="false" width="1593" height="802" darkWidth="1593" darkHeight="802" position="flex-start" showCaption="false" indent="1"}

10. To create a new user realm, navigate to **Users > User Realms > New User Realm**.&#x20;

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/3Y4OFPFVxF7QutF_NZ9E8_configonics4672x161.png" size="67" isUploading="false" initialPath="images/config_on_ics_4_672x161.png" githubPath="oauth-dg/images/config_on_ics_4_672x161.png" width="672" height="161" darkWidth="672" darkHeight="161" position="flex-start" showCaption="false" indent="1"}

11. Provide required **Names** and from the drop down **Auth Servers**, choose the OAuth Server created in the above Step. :inlineImage[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/hqT8839vAqctR_jHOlBvQ_configonics5.png" alt caption size="65" width="646" height="810"}
12. **Save Changes** and complete the rest of the steps for Role mapping rules.
13. To create a Sign in policy, navigate to **Authentication > Signing In > Sign-in Policies**.&#x20;

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/G9aKHmvQI5N-KLSUNUTou_configonics6672x232.png" size="67" isUploading="false" initialPath="images/config_on_ics_6_672x232.png" githubPath="oauth-dg/images/config_on_ics_6_672x232.png" width="672" height="232" darkWidth="672" darkHeight="232" position="flex-start" showCaption="false" indent="1"}

14. Click **New URL** to create a New Sign-in policy.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/dTmsBgkhPtJ8VtP3NMlnV_configonics7.png" size="67" isUploading="false" initialPath="images/config_on_ics_7.png" githubPath="oauth-dg/images/config_on_ics_7.png" width="672" height="812" darkWidth="672" darkHeight="812" position="flex-start" showCaption="false" indent="1"}

15. Provide the required fields like **Name** and then select **User picks from a list of authentication realms**, from the **Available Realms** list in left column, choose newly created realm in the Step above and click **Add**.

::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/xIIdFbL4bNJciHCjHBEhD_configonics8.png" size="63" isUploading="false" initialPath="images/config_on_ics_8.png" githubPath="oauth-dg/images/config_on_ics_8.png" width="629" height="373" darkWidth="629" darkHeight="373" position="flex-start" showCaption="false" indent="1"}

16. Click **Save Changes**.