https://community.esri.com/t5/arcgis-enterprise-ideas/use-openid-configuration-file-for-oidc-login-setup/idi-p/1368641 <P>Add a button in the OIDC login setup to read the openid-configuration metadata endpoint.</P><P>ArcGIS Enterprise Portal supports OpenIDConnect (OIDC) login from an upstream identity provider; this is a modern standard which is replacing the older SAML authentication.</P><P>In the configuration documentation (<A href="https://enterprise.arcgis.com/en/portal/latest/administer/windows/openid-connect-logins.htm" target="_blank">https://enterprise.arcgis.com/en/portal/latest/administer/windows/openid-connect-logins.htm</A>), it suggests that the user should open the [server]/.well-known/openid-configuration JSON file and extract 6 values from it and put them into the login configuration fields.&nbsp; This should be automated by having the form pull values from that configuration file directly.&nbsp; The openid-configuration JSON follows a standard (<A title="OpenID-Connect Metadata Standard" href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata" target="_self">https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata</A>) designed precisely for this use case, where an application needs to be configured to work with an upstream identity provider.</P><P>By adding an input for the openid-configuration endpoint and a button to pull that data, 6 fields could be auto-populated: Provider issuer ID, OAuth 2.0 authorization URL, Token URL, JWKS URL, User profile URL, and Logout URL.&nbsp; Having this automated would simplify the setup experience for the user and reduce the potential for errors.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot of the OIDC configuration screen in ArcGIS Portal, showing several fields that could be populated from the openid-configuration metadata endpoint" style="width: 892px;"><img src="https://community.esri.com/t5/image/serverpage/image-id/91139i0E97AFBF708680B1/image-size/large?v=v2&amp;px=999" role="button" title="openid-configuration-esri.png" alt="Screenshot of the OIDC configuration screen in ArcGIS Portal, showing several fields that could be populated from the openid-configuration metadata endpoint" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">Screenshot of the OIDC configuration screen in ArcGIS Portal, showing several fields that could be populated from the openid-configuration metadata endpoint</span></span></P> Wed, 10 Jan 2024 21:30:03 GMT BillMitchell 2024-01-10T21:30:03Z https://community.esri.com/t5/arcgis-enterprise-ideas/use-openid-configuration-file-for-oidc-login-setup/idi-p/1368641 <P>Add a button in the OIDC login setup to read the openid-configuration metadata endpoint.</P><P>ArcGIS Enterprise Portal supports OpenIDConnect (OIDC) login from an upstream identity provider; this is a modern standard which is replacing the older SAML authentication.</P><P>In the configuration documentation (<A href="https://enterprise.arcgis.com/en/portal/latest/administer/windows/openid-connect-logins.htm" target="_blank">https://enterprise.arcgis.com/en/portal/latest/administer/windows/openid-connect-logins.htm</A>), it suggests that the user should open the [server]/.well-known/openid-configuration JSON file and extract 6 values from it and put them into the login configuration fields.&nbsp; This should be automated by having the form pull values from that configuration file directly.&nbsp; The openid-configuration JSON follows a standard (<A title="OpenID-Connect Metadata Standard" href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata" target="_self">https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata</A>) designed precisely for this use case, where an application needs to be configured to work with an upstream identity provider.</P><P>By adding an input for the openid-configuration endpoint and a button to pull that data, 6 fields could be auto-populated: Provider issuer ID, OAuth 2.0 authorization URL, Token URL, JWKS URL, User profile URL, and Logout URL.&nbsp; Having this automated would simplify the setup experience for the user and reduce the potential for errors.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot of the OIDC configuration screen in ArcGIS Portal, showing several fields that could be populated from the openid-configuration metadata endpoint" style="width: 892px;"><img src="https://community.esri.com/t5/image/serverpage/image-id/91139i0E97AFBF708680B1/image-size/large?v=v2&amp;px=999" role="button" title="openid-configuration-esri.png" alt="Screenshot of the OIDC configuration screen in ArcGIS Portal, showing several fields that could be populated from the openid-configuration metadata endpoint" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">Screenshot of the OIDC configuration screen in ArcGIS Portal, showing several fields that could be populated from the openid-configuration metadata endpoint</span></span></P> Wed, 10 Jan 2024 21:30:03 GMT https://community.esri.com/t5/arcgis-enterprise-ideas/use-openid-configuration-file-for-oidc-login-setup/idi-p/1368641 BillMitchell 2024-01-10T21:30:03Z https://community.esri.com/t5/arcgis-enterprise-ideas/use-openid-configuration-file-for-oidc-login-setup/idc-p/1566245#M4029 <P>For what it's worth, this would be relatively simple enhancement to incorporate.</P> Mon, 09 Dec 2024 15:33:26 GMT https://community.esri.com/t5/arcgis-enterprise-ideas/use-openid-configuration-file-for-oidc-login-setup/idc-p/1566245#M4029 BillMitchell 2024-12-09T15:33:26Z