Skip to main content

Integrate a generic OIDC and OAuth Server application

You can configure access to custom OpenID Connect (OIDC) applications by integrating a generic OIDC Server application on IDaaS. A Server application is a client application that can communicate securely with IDaaS using a client secret in order to obtain access tokens. Tokens are requested directly from and returned to the client application.

Before you begin, complete the following:

  • Identify the attributes that IDaaS must contain to establish a connection between IDaaS and the OIDC application.
  • Configure the account settings of your application to accept authentication attempts from your IDaaS account.

Add a generic OIDC and OAuth Server application​

Complete the following steps:

Step 1: Configure the General settings​

  1. Log in to an IDaaS account with a role assigned that allows you to configure applications on IDaaS.

  2. Click > Security > Applications. The Applications List page appears.

  3. Click Add. The Select an Application Template page appears.

  4. Do one of the following:

    • Select OpenID Connect and OAuth Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.
    • In the Search bar, enter a search option to filter for the application you want to add to IDaaS.

  5. Click Generic Server Application. The Add Generic Server Application page appears.

  6. Configure the following App Settings:

    1. Enter the Application Name.
    2. Enter the Application Description.

  7. Configure the OIDC Settings.

    1. The Client ID is generated when you create the application on IDaaS. You cannot modify the Client ID.

    2. Select the Client Authentication Method from the drop-down list. When using the token, PAR, or revocation endpoints, clients use this authentication method to authenticate to the Authorization Server.

      1. If you select one of Client Secret Basic, Client Secret Post, or Client Secret JWT, complete the following:

        • Copy (or update and copy) the Client Secret value. You can then paste the Client Secret value into the required field of your client OIDC application account settings.
        • Optional. Set and copy the Client Secret (Alternative) value as an alternative option to support client secret rollover. You can then paste the Client Secret (Alternative) value into the required field of your client OIDC application account settings.
        note

        You can define your own Client Secret values. However, Entrust recommends that you use the strong secret value provided. You can also optionally view or regenerate a new client secret.

      2. If you select Private Key JWT as the Client Authentication Method, complete the following:

        • Select JWKS URI or JWK/JWKS JSON to provide the JSON Web Key Set (JWKS) information for the application.
          • If you select JWKS URI, enter the URI where IDaaS can retrieve the JWKS information.
          • If you select JWK/JWKS JSON, enter the JWK or JWKS JSON information directly into the text box and optionally click Pretty Print to tidy the formatting.
        • Select the Supported Client Authentication Signing Algorithms to specify the allowed signing algorithms.
        note

        When you select Private Key JWT, the client secret is not used for client authentication and is removed. Instead, the client uses a private key to sign a JWT assertion that is sent to the endpoints for authentication. IDaaS uses the JWKS information to retrieve the public key needed to verify the JWT assertion sent by the client.

      3. If you select SPIFFE JWT-SVID as the Client Authentication Method, complete the following:

        • In the SPIFFE Trust Domain field, enter the trust domain that issues the client's JWT-SVIDs, for example trust.domain. This field is required.
        • Provide the trust bundle that IDaaS uses to verify the JWT-SVID signature by selecting one of the following:
          • SPIFFE Bundle JWKS URL. Enter an HTTPS URL where IDaaS retrieves the JSON Web Key Set (JWKS) for the trust domain.
          • SPIFFE Bundle JWKS JSON. Paste the JWKS JSON directly. Click Pretty Print to format the JSON for readability.
        • In the Allowed SPIFFE IDs field, add the SPIFFE ID patterns that are allowed to authenticate as this application.
        • Select the Supported Client Authentication Signing Algorithms to specify the algorithms IDaaS accepts for the JWT-SVID signature.
        note

        When you select SPIFFE JWT-SVID, the client secret is not used for client authentication. Instead, the client presents a SPIFFE-issued JWT-SVID that IDaaS validates against the configured trust domain, trust bundle, and allowed SPIFFE ID patterns. For more information, see Configure SPIFFE JWT-SVID authentication.

    3. Select the OIDC Signing Certificate used to connect to the Service Provider.

    4. From the Access Token Signing Algorithm drop-down list, select the signing algorithm that is used to sign the access tokens used with Resource Server APIs during authentication.

    5. The Grant Types are configured by default.

  8. Click Show Advanced Settings to configure advanced settings.

    1. Enter the Default Resource/Audience Request Value to include this value as the resource or audience parameter for every authorization request.

  9. Click Save.

    You should now see the Resource Servers tab.

    note

    After configuring the General settings, the Resource Servers tab appears. For Generic Server applications, Claims, Customization, and Resource Rules tabs are not available.

  10. Proceed to Step 2: Optionally, add a resource server.

Step 2: Optionally, add a resource server​

  1. Click the Resource Servers tab.
  2. Click Add Resource Server.
  3. Follow the instructions in Add an API/URL resource server.