Create an SSO integration

OCP has an integrated account system. You can configure an external integration service in OCP and log in to the OCP console by using SSO.

Prerequisites

• The current user logged in to OCP is of the ADMIN role.
• The authorization service is deployed.

Considerations

• OAUTH/OIDC integration only supports the authorization code mode.
• When logging out of OAUTH/OIDC, only the login state for the OCP application is cleared, and the login state for the SSO system is not cleared.

Procedure

Configure the OAuth2 type

Example: Integrate a third-party application with OCP using the OAuth2 type to allow users to log in with their third-party account.

1. Log in to the OCP console.

2. In the left-side navigation pane, choose System Management > External Integration. The SSO Integration List page automatically appears.

3. In the upper-right corner of the page, click Create SSO Integration. In the dialog box that appears, configure the gateway authentication parameters.

   The following table describes the parameters of the OAuth2 type.

   Parameter	Description
   Configuration Name	The configuration name will be used as the custom login name. It must start with an English letter and end with an English letter or a digit. It can contain English letters, digits, and underscores. The length must be 2 to 32 characters.
   Type	Select OAuth2.
   Enable Local Login Mode	Specifies whether to support local username and password login.
   Client ID	The application identifier, which must be consistent with the configuration when the authorization server is registered.
   Client Secret	The application key.
   Auth URL	The URL provided by the authorization server to obtain the grant code.
   User Info URL	The URL provided by the authorization server to obtain the user information.
   Token URL	The URL provided by the authorization server to obtain the access token.
   Redirect URL	The URL provided by the authorization server to callback to the OCP service. Notice If the SSO has a callback whitelist, you need to add the URL to the whitelist.
   Scope	The authorization scope of the application. Multiple scopes are separated by spaces. We recommend that you set the scope to profile. Notice When you configure SSO by using a third-party application, you must specify the scope.
   jwkSet URL	Optional. The URL provided by the authorization server to obtain the public key for authentication.
   userNameAttribute	Optional. The user name field.
   Client Authentication Method	Optional. The authentication method used to authenticate the client to the authorization server.
   Authorization Grant Type	Optional. The OAuth2 authorization method.
   User Info Authentication Method	Optional. The authentication method used to authenticate the access token when you send a resource request to the resource server.

4. Click Test Connection. The third-party authorization login page automatically appears.

5. Enter the third-party account and password, and click Third-party Login to authorize access to OCP.

6. After the test connection is successful, the structure of the user information API is returned. Fill in the user field mapping parameters based on the returned information.

   Note

   The user information API of different third-party applications usually returns different structures. To map the user information of the third-party application to the OCP user fields, you need to fill in the user information mapping form. The user field mapping is used to identify the identifier of the OCP account associated with the OAuth2 login.

7. Click Save to complete the creation of the SSO integration.

8. For information about how to enable or disable an SSO integration, see Enable or disable an SSO integration. In the SSO Integration List page, enable the created SSO integration.

Configure the OIDC type

Example: Integrate a third-party application with OCP using the OIDC type to authorize access to OCP through the third-party login account.

1. Log in to OCP.

2. In the left-side navigation pane, choose System Management > External Integration. The SSO Integration List page automatically appears.

3. In the upper-right corner of the page, click Create SSO Integration. In the dialog box that appears, configure the gateway authentication parameters.

   The following table describes the parameters of the OIDC type.

   Steps	Parameter Description
   Configuration Name	The configuration name will be used as the custom login name. It must start with an English letter and end with an English letter or a number. It can contain English letters, numbers, and underscores, and must be 2 to 32 characters in length.
   Type	Select OIDC.
   Enable Local Login Mode	Specifies whether to support local username and password login mode.
   Client ID	The application identifier, which must be consistent with the configuration when the authorization server is registered.
   Client Secret	The application key, which must be consistent with the configuration when the authorization server is registered.
   Auth URL	The URL provided by the authorization server for obtaining the grant code.
   User Info URL	The URL provided by the authorization server for obtaining user information.
   Token URL	The URL provided by the authorization server for obtaining the access token.
   Redirect URL	The URL provided by the authorization server for redirecting to the OCP service. Notice If the SSO has a callback allowlist, you need to add it to the allowlist.
   Scope	The authorization scope of the application. Multiple scopes are separated by spaces. We recommend that you set the scope to profile. Notice When you configure SSO through a third-party application, you must specify the scope.
   jwkSet URL	Optional. The URL provided by the authorization server for the public key. The public key is used for authentication.
   Issue URL	The URL of the authentication service for issuing tokens.
   Client Authentication Method	Optional. The authentication method used to authenticate the client to the authorization server.
   Authorization Grant Type	Optional. The OAuth 2.0 authorization type.
   User Info Authentication Method	Optional. The authentication method used to authenticate the client when sending a resource request to the resource server with the access token in the request.

4. You need to add a callback allowlist for testing the connection. After you add the allowlist based on the prompt on the page, click Test Connection.

5. Enter the account and password for the third-party login and click Third-Party Login to authorize access to OCP.

6. After the connection is tested, the system returns the structure of the user information API. Fill in the user field mapping parameters based on the returned information.

   Note

   The structure of the user information API returned by different third-party applications is usually different. To map the user information of the third-party application to the OCP user fields, you need to fill in the user information mapping form. The user field mapping is used to identify the identifier of the OCP account associated with the OAuth 2.0 login.

7. Click Save to complete the creation of the SSO integration.

8. For information about how to enable or disable an SSO integration, see Enable or disable an SSO integration. In the SSO Integration List page, enable the created SSO integration.