Creating, Configuring, and Using an Identity Provider

The BPC requires integration with an external Identity Provider (IdP). The BPC provides the necessary settings in the administration area for configuring the external IdP. To do this, create an Identity Provider in the BPC under “Backend Connections” and then specify it as the Identity Provider to be used in the Core Services settings.

When the BPC starts, an Identity Provider Backend Connection is created for the local Karaf with the ID idp_karaf and the name Karaf (default). This is also used immediately as the active Identity Provider.

It is recommended to use Keycloakfootnote:[Keycloak is a trademark of The Linux Foundation.] as the identity provider. Keycloak is open source and implements standards such as OpenID Connect and SAML. It can also be used to implement very complex scenarios.

Creating and Configuring an Identity Provider

Generally, identity providers are configured via Backend Connections.

General Identity Provider Configuration

The following configuration parameters can be found at Backend Connections under the type “ identity_provider.”

Settings for the “ AdditionalInfo ” group are described at Add additional organizations, roles, permissions, and other data to the user session.

Setting (Key) Group Type Description

Setting (Key)	Group	Type	Description
IdentityProvider (`identityProvider`)	Config	text/ combobox	Identity Provider Service. Values: `INUBIT`, `Datenbank (JDBC)`, `Karaf`, `Keycloak`, `OpenID Connect (OIDC)` Default: `Karaf`
IdentityProvider_URL (`identityProvider.url`)	Config	text	The URL at which the Identity Provider is accessible
IdentityProvider_Configuration (`identityProvider_configuration`)	Config	json	Configuration object for the identity provider Relevant for Keycloak and OIDC
IdentityProvider_Mappings (`identityProvider_mappings`)	Config	json	Role mapping between BPC and the identity provider. See Mapping of Organizations, Roles, and Permissions
IdentityProvider_SelfServiceURL (`identityProvider_ussUrl`)	Config	text	The URL at which the self-service portal is accessible
IdentityProvider_PasswordValidationRegExp (`identityProvider_pwdValidationRegExp`)	Config	text	Regular expression (see Java documentation) for validating passwords. For example, for `.{8,}`, the password must be at least 8 characters long. Complex example consisting of several parts: `(?=.[0-9])(?=.[a-z])(?=.[A-Z])(?=.[@#$%^&+=])(?=\S+$).{8,}` `(?=.[0-9])` - At least one digit `(?=.[a-z])` - At least one lowercase letter `(?=.[A-Z])` - At least one uppercase letter `(?=.[@#$%^&+=])` - At least one special character `(?=\S+$)` - No spaces (whitespace) `.{8,}` - At least 8 characters total
IdentityProvider_ChangeOrganisationEnabled (`identityProvider_ussChangeOrganisationEnabled`)	Frontend	bool	Enables or disables the ability to change the organization in the user interface. Default: false
IdentityProvider_ChangePasswordEnabled (`identityProvider_ussChangePasswordEnabled`)	Frontend	bool	Enables or disables the ability to change the password in the user interface. Default: false

IdentityProvider
(identityProvider)

Config

text/ combobox

Identity Provider Service.
Values: INUBIT, Datenbank (JDBC), Karaf, Keycloak, OpenID Connect (OIDC)

Default: Karaf

IdentityProvider_URL
(identityProvider.url)

Config

text

The URL at which the Identity Provider is accessible

IdentityProvider_Configuration
(identityProvider_configuration)

Config

json

Configuration object for the identity provider
Relevant for Keycloak and OIDC

IdentityProvider_Mappings
(identityProvider_mappings)

Config

json

Role mapping between BPC and the identity provider.
See Mapping of Organizations, Roles, and Permissions

IdentityProvider_SelfServiceURL
(identityProvider_ussUrl)

Config

text

The URL at which the self-service portal is accessible

IdentityProvider_PasswordValidationRegExp
(identityProvider_pwdValidationRegExp)

Config

text

Regular expression (see Java documentation) for validating passwords. For example, for .{8,}, the password must be at least 8 characters long.

Complex example consisting of several parts: (?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=])(?=\S+$).{8,}

(?=.*[0-9]) - At least one digit
(?=.*[a-z]) - At least one lowercase letter
(?=.*[A-Z]) - At least one uppercase letter
(?=.*[@#$%^&+=]) - At least one special character
(?=\S+$) - No spaces (whitespace)
.{8,} - At least 8 characters total

IdentityProvider_ChangeOrganisationEnabled
(identityProvider_ussChangeOrganisationEnabled)

Frontend

bool

Enables or disables the ability to change the organization in the user interface.
Default: false

IdentityProvider_ChangePasswordEnabled
(identityProvider_ussChangePasswordEnabled)

Frontend

bool

Enables or disables the ability to change the password in the user interface.
Default: false

Specific Identity Provider Configuration

Specific information on how to configure supported identity providers:

In addition to the specific configurations, there are others that can be configured or used with any Identity Provider:

Using an Identity Provider

One of the Identity Providers created above can now be set as the (active) IdP to be used in Core Services → Settings. If you are still unable to log in with this IdP afterward, you can find a solution at Forcing the local IdP as a fallback

Setting (Key) Group Type Description

Setting (Key)	Group	Type	Description
IdentityProvider_BackendConnection (`identityProviderBackendConnection`)	identityProvider	text/combobox	Select/set the Identity Provider Backend Connection to be used.

IdentityProvider_BackendConnection
(identityProviderBackendConnection)

identityProvider

text/combobox

Select/set the Identity Provider Backend Connection to be used.

Click “Save”!
You will then be logged out and will need to log in again. The new Identity Provider will be taken into account during this process.

Keywords: