Page tree
Skip to end of metadata
Go to start of metadata

OpenID Connect is a federation technology, comparable with SAML 2.0, that is implemented as an identity layer on top of the OAuth 2.0 protocol.

This article describes how to set up Nexus Hybrid Access Gateway to use OpenID Connect as an authentication method. In other words, it describes how to connect Hybrid Access Gateway to an external Identity Provider (IdP) that supports OpenID Connect, for example Google, or several electronic identities, such as Norwegian BankID and Verimi.

Hybrid Access Gateway has support for the authorization code flow and the implicit flow.

Expand/Collapse All

Prerequisites

 Prerequisites

From the OpenID Connect Identity Provider, have access to:

  • Client ID
  • Client Secret
  • Discovery Endpoint

From the OpenID Connect Identity Provider:

  • Order your client account and decide on your callback url that looks like this:
    https://<hostname>/wa/auth/oauth2

Step-by-step instruction

 Log in to Hybrid Access Gateway administration interface
  1. Log in to the Hybrid Access Gateway administration interface with your admin user.
 Add OpenID Connect as authentication method

For more information regarding authentication methods in Hybrid Access Gateway, see Authentication methods. You can also click the ?-sign in the administration interface for help.

  1. In the Hybrid Access Gateway administration interface, go to Manage System.
  2. Click Authentication Methods > Add Authentication Method...
  3. Select OpenID Connect and click Next.
  4. Normally, select these two check boxes:
    1. Enable authentication method
    2. Visible in authentication menu
  5. Enter the Display Name for the Identity Provider, for example "Google".
  6. Enter the Client ID and Client Secret as provided by your identity provider, which in our example is Google.
  7. Enter Discovery Endpoint, a URL provided by your identity provider.
  8. Click Next.

An alternative way, if the Discovery Endpoint cannot be used, is to specify each required endpoint separately, as indicated by the fields below the "Or" in the Hybrid Access Gateway administration interface.

Follow these steps:

  1. Go to the discovery endpoint URL.
  2. Enter the values found in the URL in the Issuer, Authorization Endpoint and Token endpoint fields.
  3. To find the Verification Key:
    1. Find "Jwks uri" in the discovery endpoint.
    2. Go to this uri.
    3. Copy the complete content to the field Verification Key.
 Add extended properties
  1. In the Hybrid Access Gateway administration interface, go to Manage System > Authentication Methods.
  2. Select the OpenID Connect method that you configured before.
  3. Go to the Extended Properties tab.
  4. Click Scopes. Specify the scopes based on what the external Identity Provider is supporting and which information that shall be returned about the authenticated user.
  5. Click Display Name Claim. Choose any claim returned by the external Identity Provider to be used as Display Name. If the selected claim is not available in the response, the authentication will fail.
  6. Click User ID Claim. Choose any claim returned by the external Identity Provider to be used as User ID. If the selected claim is not available in the response, the authentication will fail.
  7. Set Allow user not listed in any User storage to "True" to allow other users that those listed in the user storage (for example, LDAP) to have access.

  8. Click Add Extended Property... and add extended properties as required. Click the ?-sign for help.

 Make sure that Hybrid Access Gateway trusts the certificate behind the discovery endpoint

Hybrid Access Gateway must trust the certificate behind the discovery endpoint.

Follow these steps:

  1. Open the Discovery endpoint URL in any browser.
  2. Example in Chrome:
    1. In the browser, click on "Secure" or the green lock.
    2. Click Certificate.
    3. Find the certificate and the "issuer CA" of the certificate that you want to trust in the hierarchy -> Details -> Copy to file, file format is .cer.
  3. Add the CA certificate, according to the information in Add certificates.