Open topic with navigation

TIBCO® BPM Enterprise 5.5.0

# OpenID Connect Authentication

If your TIBCO BPM Enterprise application is configured to use OpenID Connect, users of your application can log in using a username and password issued by an Identity Provider (IdP) that supports OpenID Connect.

The following describes the basic flow when someone attempts to log in to an TIBCO BPM Enterprise application, which is configured to use OpenID Connect, using their IdP credentials (this assumes the user is not already logged in to TIBCO BPM Enterprise):

1. A user starts a TIBCO BPM Enterprise application that is using OpenID Connect authentication.
2. The application tries to access the TIBCO BPM Enterprise server, but the login module determines that the user is not authenticated, and that authentication is being provided by OpenID Connect.
3. The application redirects the login request to the IdP.
4. The IdP displays their login screen, requesting the user's IdP-issued credentials.
5. The user enters IdP-issued credentials.
6. After validating the user, the IdP returns an ID Token — in the form of a JSON Web Token (JWT) — to indicate a successful authentication.

   Note: Using the OpenID Access Token is not currently supported in but the login module determines that the user is not authenticated and that authentication is being provided. The OpenID ID Token is used to identify the user.

   The response from the IdP also includes the claims specified in the Auth Scope field of the OpenID Authentication shared resource.

   The IdP sends the ID Token and claims information to the "Redirect URI" that is specified in the OpenID Connect shared resource.

7. Upon receiving the ID Token from the IdP, the application redirects the request back to the TIBCO BPM Enterprise server to confirm that the user is a valid TIBCO BPM Enterprise user before logging the user into the application.

A cookie is also created when the user is validated by the TIBCO BPM Enterprise server. The cookie includes the ID Token, which is used to establish the session that is used by all other subsequent calls to the TIBCO BPM Enterprise server.

When an IdP-authenticated user logs out of the TIBCO BPM Enterprise application:

- The browser sends the value in the Logout path property to the TIBCO BPM Enterprise server. (When a user logs out, the user does not log out of the IDP but only invalidates the client session.)
- The cookie that was created upon login is removed.

Note: At any point, only a single SSO related shared resource can be enabled, that is, either SAML or OpenID.

Did you find this helpful?

Yes No
Great!
Thanks for taking the time to give us some feedback.
Sorry about that

Why wasn't this helpful? (check all that apply)

Could not find what I was looking for
Instructions confusing or unclear
Instructions did not work

Want to tell us more?

Please select at least one option or provide details about the issue!!

Error occurred while submitting feedback.

Error2 occurred while submitting feedback.

TIBCO® BPM Enterprise

Copyright © 2015-2024. Cloud Software Group, Inc. All Rights Reserved.