====== OpenID Connect Access Provider ======

Configuration for [[https://en.wikipedia.org/wiki/OpenID|OpenID Connect]] for OAuth2 Access Provider to authenticate users for 3DM Publisher Publications. \\

===== Workflow =====

  - Administrator configures Access Provider, register 3DM Publisher as Client of the Access Provider
  - Administrator configures 3DM Publisher, delegate user authentication to Access Provider
  - Administrator configures 3DM Publisher, create Publication and grant user access (Authorization) 
  - User launches 3DM Viewer 
  - User selects 3DM Viewer login option for Access Provider
  - 3DM Viewer triggers pop-up for the user to identify via the Access Provider
  - Access Provider provides ID Token with email to the 3DM Viewer (Authentication) 
  - 3DM Viewer transfers ID Token with email to 3DM Publisher for user identification (Authorization) 
  - 3DM Publisher validates ID Token with email with 3DM Publication Authorized Users via 1) user name or 2) user email
  
===== Configure Access Provider to register 3DM Publisher as Client =====

Every OAuth2 Access Provider holds a list of known Client applications it offers services to.  \\
Your 3DM Publisher Server needs to be registered as Client of the OAuth2 Service, typically the following information is required:

  * App Name: The name of your 3D Publisher Server, usually displayed when asking the user for consent. \\ Example: ''Demo Publisher''
  * Application Location: The domain(s) your 3DM Publisher Server is hosted / accessible for end-users. \\ Example: ''https://publisher.orbitgt.com''
  * Redirect URL: The URL the Access Provider will redirect to after login is complete. \\ Set to: ''<3DM Publisher Domain>/viewer/assets/oauth-flow-callback.html''. \\ Example: ''https://publisher.orbitgt.com/viewer/assets/oauth-flow-callback.html''
  * Scopes : The list of scopes the application is allowed to request. \\ Set to: ''openid email profile''
  * Application Type: Select the type that enables Authorization Code Flow. Naming differs by Access Provider.\\ Set to: Single Page Application (SPA), or Web Application, or Authorization Code Flow. 

=== Notes for Bentley IMS ===

3DM Publisher support Bentley IMS via OpenID Connect.\\ 
The Bentley IMS Access Provider is pre-configured, but disabled by default because Client registration is still required.

To register 3DM Publisher as Client of the Bentley IMS Access Provider, there are 2 options:
  * Share your Application Location.
  * Register your 3DM Publisher Server as Client with Bentley IMS, see [[https://developer.bentley.com|]]

=== Notes for Google === 

To register 3DM Publisher as Client of the Google Access Provider: 
  - Manage your OAuth2 Credentials (for a Web Application) here: [[https://console.cloud.google.com/apis/credentials]]
  - Manage your Consent Screen configuration here: [[https://console.cloud.google.com/apis/credentials/consent]]

Additionally, Google requires its Clients to pass a secret. \\
Add the Client Secret to your Access Provider configuration for 3DM Publisher.

===== Configure 3DM Publisher to delegate user authentication =====

Access Provider configurations are managed from the Publisher Console's, System page. \\
Once configured and enabled, the 3DM Viewer automatically presents the Access Provider login option to the user.

  * Code: Free of choice unique id of the Access Provider for 3DM Publisher
  * Name: Free of choice name of Access Provider for 3DM Publisher
  * OIDC Authority URL: The authority URL of the OpenID Connect Service, usually its domain.
  * Client ID: The client-id of your 3DM Publisher Client provided by the OpenID Connect Service.
  * Client Secret: The secret of your 3DM Publisher Client provided by the OpenID Connect Service (only required for Google).
  * Login Button Label: Free of choice label of the 3DM Viewer sign-in button.


===== Implement SSO for Viewer SDK =====

Implement SSO via Access Providers 
  * [[244:viewer:sdk:examples_js:autologin_publisher_access_provider]]

Alternative options to achieve an auto-login or no login experience:  
  * [[244:viewer:sdk:examples_js:bentley_ims_autologin_cloud|]]
  * [[244:viewer:sdk:examples_js:bentley_ims_autologin_publisher|]]