OIDC

OpenID Connect (OIDC) is the identity protocol on top of OAuth 2.0 used by modern web and mobile applications. Ironchip acts as the identity provider: the application redirects the user to Ironchip, which authenticates them with their method and safe zone, and returns a token with their identity.

Requirements

• An administrator account in the Ironchip admin console.
• A service that supports OIDC and whose Redirect URI you know (the address Ironchip sends the user back to after authentication).
• The users enrolled in Ironchip, or identity synchronization configured.
• The company created in Ironchip. See Integration protocols for the data to prepare.

Add the application to the company

The Applications section lists all the protected services that have been added to Ironchip and their integration type.

1. Click New Application. The Add new application window opens.

   

2. In the Application Details step, enter the application name in Name.

3. In Application integration type, select OIDC - OAUTH 2.0.

4. In Redirect URIs, enter the Redirect URI. To get it, look up its path in the service you want to integrate.

   

5. Click Next and complete the Upload Logo step to finish. The service appears in the Applications section.

Save the Client ID and Client Secret

Save the fields returned when you create the service, in this case Client ID and Client Secret. They are shown only this once, and you must enter them in the settings of the service you are integrating.

Grant access to users and groups

The information page of each application (go to Applications and select it) shows the number of successful (Correct auths) and failed (Wrong auths) authentications and the list of accesses already configured.

To grant new access:

1. In Applications, click Add in the Add access column of the application. The Add a new access window opens, with four steps.

   

2. In Select a group, search by name with Search by name and check the Add box of each group or user you want to grant access to. Then click Next.

   

   Note

   Each individual user is treated as a user within their own personal group, which carries their name.

3. In Select usernames, choose the format of the external username (External Username) used to access the application. The email tag is selected by default, but you can build another format with tags (name, surname, domain, etc.): type them in the Enter a tag box. Below it, Username example shows the username that would be generated for a sample user. This username applies only to this access: it does not replace the user’s name on the platform. Then click Next.

4. In Select authentication policies, select the authentication policies required for the group or user. You can combine several on the same line with AND (all of them must be met) or OR (one is enough). Use the + button to add policies and the x button to remove them. Then click Next.

   

5. In Review, check the summary: the application name, the selected group or user, the external username template and the authorization flow (Authorization flow). Then click Add to create the access.

The access appears in the list of accesses of the application. You can manage it at any time with the Options button: see Manage an access.