Login using OpenID Connect

Publisher supports OpenID Connect as an additional IdP (Identity Provider) that can handle user identification based on e-mail.

The basic workflow is as follows:

1. The user opens up the viewer.
2. The user selects the OpenID Connect login option and is identified using the OpenID provider (this involves a popup).
   his process ends with the identification of the user in the form of an e-mail address.
3. The user is identified as one of the known Publisher users.
   1. The Server searches for a user with a matching username.
   2. The Server searches for a user with a matching e-mail field.

When no matching user is found, the login attempt fails.

Every OAuth IMS has an internal list of Applications that it knows about, and it offers identification services to. Your Publisher instance needs to be registered here. Typically, the configuration parameters are:

1. App Name : The name of your Publisher application, usually displayed when asking the user for consent.
   Example: Demo Publisher
2. App URL : The URL of your Publisher.
   Example: https://publisher.orbitgt.com
3. CORS Domain : The list of domains cross-domain JavaScript calls are allowed from (to retrieve the final token).
   Example: publisher.orbitgt.com
4. Redirect URL : The list of URL's that are allowed as redirect URL's after authorization is completed.
   Set to: <your-app-domain>/viewer/assets/oauth-flow-callback.html
   Example: https://publisher.orbitgt.com/viewer/assets/oauth-flow-callback.html
   The Redirect URL must point to a web-page that opens without any error (HTTP 200).
5. Scopes : The list of scopes the application is allowed to request.
   Set to: openid email profile

The following settings need to be added to the publisher_3dm/configuration.ini file.
Replace <code> with an internal code for the service you are declaring.

• login.<code>.name – A user-friendly name to use in the Console.
• login.<code>.client_id – The identifier of the Client you registered in the previous step.
• login.<code>.oidc_service_url – The top-level URL of the OIDC Service.
• login.<code>.login_button – The label of the login button.
• (login.<code>.scopes) – The optional scopes to request (default is openid email).

When opening a publication, you should now see the new Login Option :

Manage your OAuth2 Credentials (for a Web Application) here: https://console.cloud.google.com/apis/credentials
Manage your Consent Screen configuration here: https://console.cloud.google.com/apis/credentials/consent

Google requires a client to pass a secret, although this is not necessary when using PKCS. This is a known issue.

• Add oauth.<code>.client_secret – The secret of the Client is required for Google.