# OIDC

> Protect an application with OpenID Connect: add it to Ironchip, save the Client ID and Client Secret, and give access to groups of users step by step.

URL: https://docs.ironchip.com/en/identidad/protocolos/oidc/

OpenID Connect (OIDC) is the identity protocol on top of OAuth 2.0 used by modern web and mobile applications. Ironchip acts as the identity provider: the application redirects the user to Ironchip, which authenticates them with their method and safe zone, and returns a token with their identity.

## Requirements

- An administrator account in the Ironchip admin console.
- A service that supports OIDC and whose **Redirect URI** you know (the address Ironchip sends the user back to after authentication).
- The users enrolled in Ironchip, or [identity synchronization](https://docs.ironchip.com/en/identidad/administracion/sincronizacion/) configured.
- The company created in Ironchip. See [Integration protocols](https://docs.ironchip.com/en/identidad/protocolos/) for the data to prepare.

## Add the application to the company

The **Applications** section lists all the protected services that have been added to Ironchip and their integration type.

1. Click **New Application**. The **Add new application** window opens.

   [Image: Applications section with the New Application button highlighted]

2. In the **Application Details** step, enter the application name in **Name**.
3. In **Application integration type**, select **OIDC - OAUTH 2.0**.
4. In **Redirect URIs**, enter the Redirect URI. To get it, look up its path in the service you want to integrate.

   [Image: Add application form with the OIDC - OAUTH 2.0 integration type and the Redirect URIs field]

5. Click **Next** and complete the **Upload Logo** step to finish. The service appears in the **Applications** section.

:::caution[Save the Client ID and Client Secret]
Save the fields returned when you create the service, in this case **Client ID** and **Client Secret**. They are shown only this once, and you must enter them in the settings of the service you are integrating.
:::

## Grant access to users and groups

The information page of each application (go to **Applications** and select it) shows the number of successful (**Correct auths**) and failed (**Wrong auths**) authentications and the list of accesses already configured.

To grant new access:

1. In **Applications**, click **Add** in the **Add access** column of the application. The **Add a new access** window opens, with four steps.

   [Image: Add access column of the Applications section with the Add button for each application]

2. In **Select a group**, search by name with **Search by name** and check the **Add** box of each group or user you want to grant access to. Then click **Next**.

   [Image: Select a group step of the Add a new access window, with the list of users and groups]

   :::note
   Each individual user is treated as a user within their own personal group, which carries their name.
   :::

3. In **Select usernames**, choose the format of the external username (**External Username**) used to access the application. The `email` tag is selected by default, but you can build another format with tags (`name`, `surname`, `domain`, etc.): type them in the **Enter a tag** box. Below it, **Username example** shows the username that would be generated for a sample user. This username applies only to this access: it does not replace the user's name on the platform. Then click **Next**.
4. In **Select authentication policies**, select the [authentication policies](https://docs.ironchip.com/en/identidad/conceptos/politicas/) required for the group or user. You can combine several on the same line with **AND** (all of them must be met) or **OR** (one is enough). Use the **+** button to add policies and the **x** button to remove them. Then click **Next**.

   [Image: Select authentication policies step with the Any user devices and Any user safezones policies combined with AND]

5. In **Review**, check the summary: the application name, the selected group or user, the external username template and the authorization flow (**Authorization flow**). Then click **Add** to create the access.

The access appears in the list of accesses of the application. You can manage it at any time with the **Options** button: see [Manage an access](https://docs.ironchip.com/en/identidad/administracion/aplicaciones/#manage-an-access).