OpenID Connect

OpenID Connect#

sysman sysadmin

With the generic OpenID Connect provider, you connect Allegra to any standards-compliant OpenID Connect identity provider that is not covered by the preconfigured types. The login page shows the button Continue with SSO.

At your identity provider, register an application (client) for Allegra and register the callback URL shown in the provider form as the redirect URI (see Callback URL).

In Allegra, go to Administration > Users & Groups > Authentication > OpenID providers and add the provider OpenID Connect. The configuration form is described in OpenID Providers; for the generic provider, note:

  • Issuer URL — the base URL of the identity provider. The OpenID Connect endpoints are discovered from it.

  • Logout URL — optional: the absolute logout endpoint of the identity provider. If left empty, the logout endpoint discovered from the issuer URL is used. This field only exists for the generic provider type.

For user matching, the provider’s email claim is used; see User matching and auto-registration.

Note

If the identity provider offers no logout endpoint, signing out of Allegra ends the Allegra session only.