Open ID Authentication

You can configure OpenID Authentication policy by using Open ID Authentication resource template.

Field/Button Description
Description (optional) A description for the OpenID resource.
Access token URI

The REST OpenID token service URI, which is used to obtain an ID Token for the authenticated user.

Note: Using the OpenID Access Token is not currently supported in ActiveMatrix Service Grid - Container Edition. The OpenID ID Token is used to identify the user.

This is unique to the IdP and can be obtained from the IdP's website on which they describe how to register an application with the IdP.

Examples:

Google: https://www.googleapis.com/oauth2/v3/token

Microsoft AD FS: https://host:port/adfs/oauth2/token

Here,

  • host is the DNS name or IP address of the server that hosts TIBCO ActiveMatrix,

  • port is the port used by the application.
Client ID The ID that identifies the client at the Identify Provider (IdP). This and the Client Secret (see below) are obtained from the IdP when the client registers an application with the IdP for the purpose of providing authentication for users.
Client Secret The password for the Client ID account. See the description above.
Redirect URI

The URI to which the IdP redirects the user after authenticating the user and generating an ID Token.

http://host:port/appPath

Here,

  • host is the DNS name or IP address of the server that hosts TIBCO ActiveMatrix,

  • port is the port used by the application, and

  • appPath is the path to your Web application.

Note: This URI must exactly match the Redirect URI that was specified when registering the application with the IdP.
Authorization URI The REST Open ID user claims/information service URI, which is used to obtain user profile information.

This URI can be obtained from the IdP's website on which they describe how to register an application with the IdP.

Examples:

Google: https://accounts.google.com/o/oauth2/auth

Microsoft AD FS: https://host:port/adfs/oauth2/authorize

Here,

  • host is the DNS name or IP address of the server that hosts TIBCO ActiveMatrix,

  • port is the port used by the application.
Auth Scope (optional) Defines the claims to be returned by the IdP when the IdP authenticates the user and issues anID Token. These claims are user attributes and are intended to provide the application with user details.

The openid scope is included by default (even though it does not appear in the Auth Scope field by default). (The openid scope causes the sub claim to be returned, which uniquely identifies the user.) However, if any scope is entered in the Auth Scope field, it overrides the default value of openid. Therefore, if your IdP requires the openid scope, plus another scope, you must also specify openid. Specify the scopes required by your IdP.

Examples:

Google and Microsoft AD FS: openid, email

Multiple scopes can be comma- or space-separated in the Auth Scope field.
User Key (optional)

From the list of claims that are returned from the IdP (based on the scope), this specifies the field that is used as a User ID.

For example:

Google and Microsoft AD FS: email
JSON Web Key Set URI The URI to the JSON Web Key Set (JWKS), which is a JSON data structure that represents a set of public keys used to verify the signature of the JSON Web Token (JWT)ID issued by the IdP.

This is unique to the IdP and can be obtained from the IdP's website on which they describe how to register an application with the IdP.

Examples:

Google: https://www.googleapis.com/oauth2/v3/certs

Microsoft AD FS: https://host:port/adfs/discovery/keys

Here,

  • host is the DNS name or IP address of the server that hosts TIBCO ActiveMatrix,

  • port is the port used by the application.
Logout Path When a user logs out of a TIBCO ActiveMatrix Web application, the browser sends this value to the TIBCO ActiveMatrix server. This property must be set to:

/logout

This value indicates to the server that it needs to send a request to the IdP to log the user out, using the value specified in the SignOutURL property (see below).
Signout URL Upon receiving /logout in the LogOutPathproperty, the server uses this URL to send the IdP a request to log the user out of the IdP.

The Signout URL is specific to the IdP.

Examples:

Google: https://www.google.com/accounts/Logout?continue=https://appengine.google.com/_ah/logout?continue=http://host:port/appPath/logout

Here,

  • host is the DNS name or IP address of the server that hosts TIBCO ActiveMatrix,

  • port is the port used by the application, and

  • appPath is the path to the application's landing page.

Microsoft AD FS: https://host:port/adfs/ls/?wa=wsignout1.0&wreply=http://host:port/appPath

Here,

  • host is the DNS name or IP address of the server that hosts TIBCO ActiveMatrix,

  • port is the port used by the application, and

  • appPath is the path to the application's landing page.
Unauthorized Redirect Requests (optional) Specifies whether it is the responsibility of the application to handle unauthorized redirect requests. Select this option if you want the application to handle unauthorized requests and forward them to the appropriate location. For example, TIBCO ActiveMatrix BPM handles unauthorized requests. Therefore, for TIBCO ActiveMatrix BPM applications, this option must be selected.