OpenID Connect Directory Manager Plugin

Introduction

The OpenID Directory Manager plugin allows you to authenticate users who sign in to Joget through OpenID Connect.

• Upon clicking the login button, users are redirected to the configured OpenID Connect site for authentication.
• After successful authentication, users are redirected to Joget using the Callback URL configured in the plugin.

JogetOSS is a community-led team for open-source software related to the Joget no-code/low-code application platform. Projects under JogetOSS are community-driven and community-supported, and you are welcome to contribute to the projects.

Get started

Where to get the plugin

You can download the plugin from Joget Marketplace.

How to install

1. Download the plugin JAR file from the Joget Marketplace.
2. Go to Settings > Manage Plugins > Upload Plugin.
3. Once uploaded, the plugin will be available in your Joget environment.

How to use it

1. Set up the API Domain Whitelist in System Settings to *.
   Important:
   If this is not set, you will get a 400 Forbidden error when performing the SSO
2. In System Settings > Directory Manager, select the OpenID Connect Plugin.
3. Provide the callback URL to your OID provider and obtain the necessary settings.
4. Configure the plugin using the settings provided by your OID provider.

Configure openID connect properties

OpenID provider details

• Callback URL: URL to which Auth0 redirects users after they authenticate.
  Ensure to provide this Callback URL to your OpenID Connect service.
• Issuer: 
  
  • Issuer URL
  • Custom
• Issuer URL: URL which is used to validate the discovery URL (Issuer URL + "/.well-known/openid-configuration") 
• URL where Auth0 can find the OpenID Provider Configuration Document, which should be available in the  /.well-known/openid-configuration  endpoint.
• Authorization Token Endpoint: Authorization server's authorization endpoint, which you can retrieve using the server's Metadata URI (Issuer URL + "/.well-known/openid-configuration"). 
  
  Sample Format
  https://${Issuer URL}/oauth2/${authServerId}/v1/authorize
  Available when Issuer is set to Custom.
• Token Endpoint: The endpoint on the Authorization Server is used to programmatically request tokens,  which you can retrieve using the server's Metadata URI (Issuer URL + "/.well-known/openid-configuration"). 
  
  Sample Format
  https://${Issuer URL}/oauth2/${authServerId}/v1/token
  Available when Issuer  is set to Custom.
• User Info Endpoint: 

  User Profile Information,  which you can retrieve using the server's Metadata URI (Issuer URL + "/.well-known/openid-configuration"). 

  Sample Format
  https://${Issuer URL}/oauth2/${authServerId}/v1/userinfo
  Available when Issuer is set to Custom.
• JSON Web Key Set: Issued by the authorization server and signed using the RS256 signing algorithm
  Sample Format
  https://${Issuer URL}/oauth2/${authServerId}/v1/keys
  Available when Issuer is set to Custom.
• Response Types Supported: By default, code.
• Client ID: The Client ID provisioned by the OpenID provider when the client was registered.
• Client Secret: The Client Secret (password) provisioned by the OpenID provider when the client was registered.
• Scope: A list of Auth0 scopes to request when connecting to the Identify Provider. By default, openid profile email.
• User Provisioning Enabled: If enabled, ensures the user account is created in Joget's User Directory.
• Save Access Token And Refresh Token To User Meta?: If enabled, saves access token and refresh token (if available, may need to include offline_access in Scope) to user meta: oidcAccessToken and oidcRefreshToken

  Tokens can be accessible with the User Meta Hash Variable.

  • #currentUser.meta.oidcAccessToken#
  • #currentUser.meta.oidcRefreshToken#

  Access token can also be refreshed with a Hash Variable #oidc.refreshAccessToken# which will attempt to get a new set of tokens with refresh token if the current access token has expired.

Configure openID connect login button

• Login Button Text: Login button styling text
  Sample Value
  Login
• Login Button Icon: Login button styling icon class
  Sample Value
  fas fa-arrow-right
• Button Text Color: Login button styling button text color
  Sample Value
  white
• Button Background Color: Login button styling button background-color
  Sample Value
  black

Sample configurations for openID connect identity providers

Download plugin

• OpenID Connect Directory Manager Plugin