Set up Digital Access component as OpenID Connect relying party

From the OpenID Connect Identity Provider, have access to:

• Client ID
• Client Secret
• Discovery Endpoint

From the OpenID Connect Identity Provider:

• Order your client account and decide on your callback url that looks like this:
  https://<hostname>/wa/auth/oauth2
  

1. Log in to Digital Access Admin with an administrator account.

For more information regarding authentication methods in Digital Access component, see Authentication methods in Digital Access. You can also click the ?-sign in the administration interface for help.

1. In Digital Access Admin, go to Manage System.
2. Click Authentication Methods > Add Authentication Method...
3. Select OpenID Connect and click Next.
4. Normally, select these two check boxes:
   1. Enable authentication method
   2. Visible in authentication menu
5. Enter the Display Name for the Identity Provider, for example "Google".
6. Enter the Client ID and Client Secret as provided by your identity provider, which in our example is Google.
7. Enter Discovery Endpoint, a URL provided by your identity provider.
8. Click Next.

An alternative way, if the Discovery Endpoint cannot be used, is to specify each required endpoint separately, as indicated by the fields below the "Or" in Digital Access Admin.

Follow these steps:

1. Go to the discovery endpoint URL.
2. Enter the values found in the URL in the Issuer, Authorization Endpoint and Token endpoint fields.
3. To find the Verification Key:
   1. Find "Jwks uri" in the discovery endpoint.
   2. Go to this uri.
   3. Copy the complete content to the field Verification Key.

1. In Digital Access Admin, go to Manage System > Authentication Methods.
2. Select the OpenID Connect method that you configured before.
3. Go to the Extended Properties tab.
4. Click Scopes. Specify the scopes based on what the external Identity Provider is supporting and which information that shall be returned about the authenticated user.
5. Click Display Name Claim. Choose any claim returned by the external Identity Provider to be used as Display Name. If the selected claim is not available in the response, the authentication will fail.
6. Click User ID Claim. Choose any claim returned by the external Identity Provider to be used as User ID. If the selected claim is not available in the response, the authentication will fail.

7. Set Allow user not listed in any User storage to "True" to allow other users that those listed in the user storage (for example, LDAP) to have access.

8. Click Add Extended Property... and add extended properties as required. Click the ?-sign for help.

Digital Access component must trust the certificate behind the discovery endpoint.

Follow these steps:

1. Open the Discovery endpoint URL in any browser.
2. Example in Chrome:
   1. In the browser, click on "Secure" or the green lock.
   2. Click Certificate.
   3. Find the certificate and the "issuer CA" of the certificate that you want to trust in the hierarchy -> Details -> Copy to file, file format is .cer.
3. Add the CA certificate, according to the information in Add certificates in Digital Access.