Creating, Configuring, and Using an Identity Provider

The BPC requires integration with an external identity provider (IdP). The BPC provides the necessary settings in the administration area for configuring the external IdP. To do this, create an Identity Provider in the BPC under “Backend Connections” and then specify it as the Identity Provider to be used in the Core Services settings.

When the BPC starts, an Identity Provider Backend Connection is created for the local Karaf with the ID idp_karaf and the name Karaf (default). This is immediately used as the active Identity Provider.

It is recommended to use Keycloakfootnote:[Keycloak is a trademark of The Linux Foundation.] as the identity provider. Keycloak is open source and implements standards such as OpenID Connect and SAML. It can also be used to implement very complex scenarios.

Creating and Configuring an Identity Provider

Generally, identity providers are configured via Backend Connections.

General Identity Provider Configuration

The following configuration parameters can be found at Backend Connections under the type “ identity_provider.”

Settings for the “ AdditionalInfo ” group are described at Add additional organizations/roles/permissions and other data to the user session.

Setting (Key) Group Type Description

Setting (Key)	Group	Type	Description
IdentityProvider (`identityProvider`)	Config	text/combobox	Identity Provider Service. Values: `Datenbank (JDBC)`, `Karaf`, `Keycloak`, `OpenID Connect (OIDC)` Default: `Karaf`
IdentityProvider_Mappings (`identityProvider_mappings`)	Config	json	Role mapping between BPC and the Identity Provider. See Mapping of Organizations, Roles, and Permissions
IdentityProvider_HealthEndpoint (`identityProvider_healthEndpoint`)	Config	text	Health endpoint of the identity provider. If set, the status of the identity provider can be queried via the status API. Example: http://<keycloak_addr>:9000/health/ready
IdentityProvider_PasswordValidationRegExp (`identityProvider_pwdValidationRegExp`)	Config	text	Regular expression (see Java documentation) for validating passwords. For example, with `.{8,}`, the password must be at least 8 characters long. Complex example consisting of several parts: `(?=.[0-9])(?=.[a-z])(?=.[A-Z])(?=.[@#$%^&+=])(?=\S+$).{8,}` `(?=.[0-9])` - At least one digit `(?=.[a-z])` - At least one lowercase letter `(?=.[A-Z])` - At least one uppercase letter `(?=.[@#$%^&+=])` - At least one special character `(?=\S+$)` - No spaces (whitespace) `.{8,}` - At least 8 characters total
IdentityProvider_ChangeOrganisationEnabled (`identityProvider_ussChangeOrganisationEnabled`)	Frontend	bool	Enables or disables the ability to change the organization in the user interface. Default: false
IdentityProvider_ChangePasswordEnabled (`identityProvider_ussChangePasswordEnabled`)	Frontend	bool	Enables or disables the ability to change the password in the user interface. Default: false

IdentityProvider
(identityProvider)

Config

text/combobox

Identity Provider Service.
Values: Datenbank (JDBC), Karaf, Keycloak, OpenID Connect (OIDC)

Default: Karaf

IdentityProvider_Mappings
(identityProvider_mappings)

Config

json

Role mapping between BPC and the Identity Provider.
See Mapping of Organizations, Roles, and Permissions

IdentityProvider_HealthEndpoint
(identityProvider_healthEndpoint)

Config

text

Health endpoint of the identity provider. If set, the status of the identity provider can be queried via the status API.

Example: http://<keycloak_addr>:9000/health/ready

IdentityProvider_PasswordValidationRegExp
(identityProvider_pwdValidationRegExp)

Config

text

Regular expression (see Java documentation) for validating passwords. For example, with .{8,}, the password must be at least 8 characters long.

Complex example consisting of several parts: (?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=])(?=\S+$).{8,}

(?=.*[0-9]) - At least one digit
(?=.*[a-z]) - At least one lowercase letter
(?=.*[A-Z]) - At least one uppercase letter
(?=.*[@#$%^&+=]) - At least one special character
(?=\S+$) - No spaces (whitespace)
.{8,} - At least 8 characters total

IdentityProvider_ChangeOrganisationEnabled
(identityProvider_ussChangeOrganisationEnabled)

Frontend

bool

Enables or disables the ability to change the organization in the user interface.
Default: false

IdentityProvider_ChangePasswordEnabled
(identityProvider_ussChangePasswordEnabled)

Frontend

bool

Enables or disables the ability to change the password in the user interface.
Default: false

Specific Identity Provider Configuration

Specific information on how to configure supported identity providers:

In addition to the specific configurations, there are others that can be configured or used with any identity provider:

Using an Identity Provider

One of the identity providers created above can now be set as the active IdP in Core Services → Settings. If you are still unable to log in with this IdP afterward, you can find a solution at Forcing the local IdP as a fallback

Setting (Key) Group Type Description

Setting (Key)	Group	Type	Description
IdentityProvider_BackendConnection (`identityProviderBackendConnection`)	identityProvider	text/combobox	Select/set the Identity Provider Backend Connection to be used.

IdentityProvider_BackendConnection
(identityProviderBackendConnection)

identityProvider

text/combobox

Select/set the Identity Provider Backend Connection to be used.

idp select active

Click “Save”!
You will then be logged out and will need to log in again. The new Identity Provider will be taken into account during this process.

Keywords: