Enter ID Provider Data in User Management

You have the option to store login credentials for identity providers in User Management.

Default values have already been set for the following identity providers:

  • Microsoft Azure

  • Keycloak

  • Okta

  • Google

Step-by-Step

To enter access credentials for identity providers in User Management, follow these steps:

  1. Launch the "Users" module.

  2. From the "User" menu, select "Configuration."

    The "User Manager Configuration" dialog box appears.

  3. Under "Web," click the icon.

    The "Binding: Web" dialog box appears.

  4. Enable the "OAuth2 Authentication" option ().

  5. Click the " " icon (Add Provider) ().

    The "Select Provider" dialog box appears.

  6. Select the desired provider or select the "Custom" tile.

  7. Click "Next."

  8. The "Configure Provider" dialog box appears for the previously selected provider.

    The dialog box already contains some or all of the values known for the respective provider.

    Provider Settings

    Name

    Enter a name for the provider configuration here. The name must be unique. You can override the name preset by Intrexx.

    Client ID

    Enter the client ID here. You must obtain these from the ID provider. For more information, see the " Client ID" and "Client Secret" sections.

    Client Secret

    Enter the client secret here. You must obtain this from the ID provider. For more information, see the " Client ID and Client Secret" section.

    Scope

    The provider's scope must be specified here. The value is pre-populated by Intrexx.

    You can (also) obtain the value from the ID provider. For more information, see the " REST API Endpoints" section.

    Access Token URL

    The provider's access token URL must be entered here. Intrexx pre-fills this value completely for some providers and partially for others.

    If the value is partially pre-filled, it contains variables whose values you must obtain from the provider. (In Microsoft Azure, this is the "tenant ID.") See the " REST API Endpoints" section for more information.

    User Authentication URL

    The user authentication URL for authorization with the provider must be specified here. Intrexx pre-fills this value completely for some providers and partially for others.

    If the value is partially pre-filled, it contains variables whose values you must obtain from the provider. (In Microsoft Azure, this is the "tenant ID.") See the " REST API Endpoints" section for more information.

    Public-Key Source

    The "Public Key Source"—the URL for the provider's public keys—must be entered here. Intrexx pre-fills this value completely for some providers and partially for others.

    If the value is partially pre-filled, it contains variables whose values you must obtain from the provider. (In Microsoft Azure, this is the "tenant ID.") See the " REST API Endpoints" section for more information.

    User Info URL

    You can enter the "User Info URL"—the URL for the user information endpoint—here. This field can be left blank. It is pre-filled with the appropriate value from Intrexx if the value is required. If the value is partially pre-filled, it contains variables whose values you must obtain from the provider.

    Redirect URL

    The "Redirect URL" must be entered here. It is pre-filled by Intrexx. The redirect URL consists of your portal's base URL and the following components: "/oauth2/login/<provider name>"

    For more information, see the section on setting the redirect URL.

    Mapping

    When the ID provider sends authentication data (ID tokens) to Intrexx, Intrexx maps the user in the ID provider to the corresponding user in the Intrexx user management system.
    Users are mapped using a unique field (attribute) in both the ID provider and Intrexx (user master data field). Usually, the user's email address is used for this purpose. It is important that the values in the selected user master data field are unique. If multiple users are identified based on a token value, the login process is aborted with an error.

    Intrexx pre-populates the mapping with the provider field name "email" and the database field "Work Email."

    Provider Field Name

    You must obtain the provider field name from the provider.

    Database Field

    For database fields, you can select data fields of the String type. You can also choose from custom data fields. Intrexx pre-populates the mapping with the provider field name "email" and the database field "Business Email."

    Enable user registration

    After successfully logging in, you can optionally register a new Intrexx user if one does not yet exist, or edit an existing Intrexx user. Groovy scripts are required for execution; these can be configured using the Web Binding dialog.

    For detailed information on this, see the section " Enable user registration."

    Nonce required

    Here you can specify whether the provider requires a nonce ("number used once").

    You can find out from the provider whether it requires a nonce. The value is pre-populated by Intrexx.

    Additional Redirect Parameters

    You have the option to specify additional redirect parameters. Each of these consists of a key and a value. Intrexx pre-fills redirect parameters if necessary.

    1. Click the " " icon.

      The "Additional Redirect Parameters" dialog box appears.

    2. Click the " " icon.

      The "Add Parameter" dialog box appears.

    3. Enter the key and its value here.

    4. Click "OK."

      You will be taken back to the "Additional Redirect Parameters" dialog box.

    5. Click "OK."

      You will return to the "Configure Provider" dialog box.

    Login button on the web

    Title

    Enter the text you want to appear on the button here.

    Style Class

    Enter the name of the style class to be used for the login button here.

    Intrexx sets the style class to "Button_Standard."

    Custom style classes can be defined in the "Layout" module.

    View on the Web

    Here you can specify whether or not the login button should be displayed on the website.

    (Hiding the button may be useful, for example, during a test phase or if a provider is temporarily unavailable.)

    Add the provider's icon to the login button

    You have the option to place the provider's icon or another icon on the login button. For detailed information on this, see the section " Customize the login button for your identity provider."

  9. Click "Finish."

More Information