Set Up OIDC Authentication
Table of Contents
Expand all | Collapse all
-
- Cloud Identity Engine Attributes
- Collect Custom Attributes with the Cloud Identity Engine
- View Directory Data
- Cloud Identity Engine User Context
- Create a Cloud Dynamic User Group
- Configure Third-Party Device-ID
- Configure an IP Tag Cloud Connection
- Configure Dynamic Privilege Access in the Cloud Identity Engine
-
-
- Configure Azure as an IdP in the Cloud Identity Engine
- Configure Okta as an IdP in the Cloud Identity Engine
- Configure PingOne as an IdP in the Cloud Identity Engine
- Configure PingFederate as an IdP in the Cloud Identity Engine
- Configure Google as an IdP in the Cloud Identity Engine
- Configure a SAML 2.0-Compliant IdP in the Cloud Identity Engine
- Configure a Client Certificate
- Set Up OIDC Authentication
- Set Up an Authentication Profile
- Configure Cloud Identity Engine Authentication on the Firewall or Panorama
- Configure the Cloud Identity Engine as a Mapping Source on the Firewall or Panorama
- Configure Dynamic Privilege Access in the Cloud Identity Engine
-
- Get Help
Set Up OIDC Authentication
Learn how to configure OpenID Connect (OIDC) as an authentication type for the Cloud
Identity Engine.
OpenID Connect (OIDC) provides additional flexibility for your Cloud Identity Engine
deployment. By supporting single-sign on (SSO) across multiple applications, OIDC
simplifies authentication for users, allowing them to log in once with the OIDC
provider to access multiple resources without needing to log in repeatedly.
To configure an OpenID Connect (OIDC) provider as an authentication type in the Cloud
Identity Engine, complete the following steps for your identity provider (IdP) type.
When you configure OIDC as an authentication type, the
Cloud Identity Engine determines the username attribute using the following order
(where if the current attribute is not found, the Cloud Identity Engine attempts to
match using the next attribute in the list):
- email
- preferred_username
- username
- sub
Configure OIDC for Azure
- Set up OIDC as an authentication type in the Cloud Identity Engine.
- Select.AuthenticationAuthentication TypesAdd New Authentication Type
- Set Upthe OIDC authentication type.
- Enter a unique and descriptiveAuthentication Type Namefor your OIDC configuration.
- Copy theCallback URL/ Redirect URL.
- Configure Azure to use OIDC with the Cloud Identity Engine.
- Log in to the Azure account you want to use to connect to the Cloud Identity Engine.
- ClickApp registration.
- ClickNew registration.
- Enter aNamefor the application.
- SelectAccounts in this organizational directory only.
- For theRedirect URI, enter the domain for your Cloud Identity Engine instance and appendoidc/callback
- ClickRegisterto submit the configuration.
- ClickAdd user/groupand add the users or groups you want to be able to configure OIDC as an authentication type (for example, service accounts).
- Obtain the information you need to complete your OIDC Azure configuration.
- Select the application you just created then clickOverview.
- Copy theDisplay nameandApplication (client) IDand save them in a secure location.
- ClickAdd a certificate or secret.
- SelectClient secretsthen clickNew client secret.
- Select when the secretExpiresthen clickAdd.You must add a new secret before the current secret expires to successfully connect with the Cloud Identity Engine.
- CopytheValueand theSecret IDof the client secret and save them in a secure location.Because the secret displays only once, be sure to copy the information before closing or leaving the page. Otherwise, you must create a new secret.
- (Optional) SelectandOverviewEndpointsCopytheOpenID Connect metadata documentup to/2.0(thewell-known/openid-configurationsection of the URL isn't necessary).
- Complete and submit the OIDC configuration.
- Enterhttps://login.microsoftonline.com/organizations/2.0as theIssuer URL.
- (Optional) Enter theEndpoint URLyou copied in step 3.g.
- ClickTest Connectionand log in to confirm that the Cloud Identity Engine can reach your Azure IdP using OIDC.If you did not enter the OIDC Issuer URL in the previous step, the Cloud Identity Engine automatically populates the information.
- After confirming that the connection is successful,Submitthe configuration.You can now use OIDC as an authentication type when you Set Up an Authentication Profile.
Configure OIDC for Okta
- Set up OIDC as an authentication type in the Cloud Identity Engine.
- Select.AuthenticationAuthentication TypesAdd New Authentication Type
- Set Upthe OIDC authentication type.
- Enter a unique and descriptiveAuthentication Type Namefor your OIDC configuration.
- Copy theCallback URL/ Redirect URL.
- Configure Okta to use OIDC with the Cloud Identity Engine.
- Sign into Okta.
- Select.ApplicationsApplications
- ClickCreate App Integration.
- SelectOIDC - OpenID Connectas theSign-in methodandWeb Applicationas theApplication Typethen clickNext.
- Enter anApp integration name.
- ClickAdd URIand enter the information you copied in step 1.d.
- Select theControlled Accessyou want to allow then clickSave.
- Obtain the information you need to complete your OIDC Okta configuration.
- CopytheClient ID.
- CopytheSecret.The secret for Okta does not expire.
- Complete and submit the OIDC configuration.
- Enter theClient IDyou copied from Okta in step 3.a.
- Enter the domain name URL for your Okta IdP as theIssuer URL.
- (Optional) If you have yourEndpoint URL, enter it here. If not, continue to the next step (the Cloud Identity Engine populates theEndpoint URLautomatically after you successfully test the connection).
- ClickTest Connectionand log in to confirm that the Cloud Identity Engine can reach your Okta IdP using OIDC.If you did not enter the OIDC Issuer URL in the previous step, the Cloud Identity Engine automatically populates the information.
- After confirming that the connection is successful,Submitthe configuration.You can now use OIDC as an authentication type when you Set Up an Authentication Profile.
Configure OIDC for PingOne
- Set up OIDC as an authentication type in the Cloud Identity Engine.
- Select.AuthenticationAuthentication TypesAdd New Authentication Type
- Set Upthe OIDC authentication type.
- Enter a unique and descriptiveAuthentication Type Namefor your OIDC configuration.
- Copy theCallback URL/ Redirect URL.
- Configure PingOne to use OIDC with the Cloud Identity Engine.
- Sign Onto your PingOne account.
- SelectApplications.
- SelectOIDCthen clickAdd Application.
- SelectWeb Appthen clickNext.
- Enter anApplication Name, aShort Descriptionfor the app, and select the appCategory, then clickNext.
- Continue the OIDC Okta configuration.
- ClickAdd Secretthen clickNext.
- Enter theStart SSO URLand theRedirect URIsthen clickNext.
- ClickNext.No configuration changes are necessary for this step.
- Add all the scopes in theList of Scopesto theConnected Scopesthen clickNext.
- SelectEmail (Work)as thesubattribute then clickNext.
- Select all theAvailable Groupsand add them to theAdded Groupsthen clickDone.
- Obtain the information you need to complete your OIDC PingOne configuration and enter it in your Cloud Identity Engine configuration.
- Enter theClient IDyou created in PingOne in step 3.a.
- (Optional) If you have yourEndpoint URL, enter it here. If not, continue to the next step (the Cloud Identity Engine populates theEndpoint URLautomatically after you successfully test the connection).
- ClickTest Connectionand log in to confirm that the Cloud Identity Engine can reach your PingOne IdP using OIDC.If you did not enter the OIDC Issuer URL in the previous step, the Cloud Identity Engine automatically populates the information.
- After confirming that the connection is successful,Submitthe configuration.You can now use OIDC as an authentication type when you Set Up an Authentication Profile.
Configure OIDC for Google
- Set up OIDC as an authentication type in the Cloud Identity Engine.
- Select.AuthenticationAuthentication TypesAdd New Authentication Type
- Set Upthe OIDC authentication type.
- Enter a unique and descriptiveAuthentication Type Namefor your OIDC configuration.
- Copy theCallback URL/ Redirect URL.
- Configure Google to use OIDC with the Cloud Identity Engine.
- Select your account andEnter your passwordthen clickNext.
- Create a new project or select an existing project.
- Enable theIdentity and Access Management (IAM)API (if it's not already enabled).
- Selectthen configure the OAuth consent screen.APIs & ServicesOAuth consent screen
- Create your OAuth 2.0 credentials, copy theClient IDandClient Secret, and store them in a secure location.
- Obtain the information you need to complete your OIDC Google configuration and enter it in your Cloud Identity Engine configuration.
- Enter the application name you entered in step 2.d as theClient Name.
- Enter theClient IDyou copied in step 2.e.
- Enter theClient Secretyou copied in step 2.e.
- (Optional) If you have yourEndpoint URL, enter it here. If not, continue to the next step (the Cloud Identity Engine populates theEndpoint URLautomatically after you successfully test the connection).
- ClickTest Connectionand log in to confirm that the Cloud Identity Engine can reach your Google IdP using OIDC.If you did not enter the OIDC Issuer URL in the previous step, the Cloud Identity Engine automatically populates the information.
- After confirming that the connection is successful,Submitthe configuration.You can now use OIDC as an authentication type when you Set Up an Authentication Profile.