OpenID Connect Access Provider

Configuration for OpenID Connect for OAuth2 Access Provider to authenticate users for 3DM Publisher Publications.

1. Administrator configures Access Provider, register 3DM Publisher as Client of the Access Provider
2. Administrator configures 3DM Publisher, delegate user authentication to Access Provider
3. Administrator configures 3DM Publisher, create Publication and grant user access (Authorization)
4. User launches 3DM Viewer
5. User selects 3DM Viewer login option for Access Provider
6. 3DM Viewer triggers pop-up for the user to identify via the Access Provider
7. Access Provider provides ID Token with email to the 3DM Viewer (Authentication)
8. 3DM Viewer transfers ID Token with email to 3DM Publisher for user identification (Authorization)
9. 3DM Publisher validates ID Token with email with 3DM Publication Authorized Users via 1) user name or 2) user email

Every OAuth2 Access Provider holds a list of known Client applications it offers services to.
Your 3DM Publisher Server needs to be registered as Client of the OAuth2 Service, typically the following information is required:

• App Name: The name of your 3D Publisher Server, usually displayed when asking the user for consent.
  Example: Demo Publisher
• Application Location: The domain(s) your 3DM Publisher Server is hosted / accessible for end-users.
  Example: https://publisher.orbitgt.com
• Redirect URL: The URL the Access Provider will redirect to after login is complete.
  Set to: <3DM Publisher Domain>/viewer/assets/oauth-flow-callback.html.
  Example: https://publisher.orbitgt.com/viewer/assets/oauth-flow-callback.html
• Scopes : The list of scopes the application is allowed to request.
  Set to: openid email profile
• Application Type: Select the type that enables Authorization Code Flow. Naming differs by Access Provider.
  Set to: Single Page Application (SPA), or Web Application, or Authorization Code Flow.

3DM Publisher support Bentley IMS via OpenID Connect.
The Bentley IMS Access Provider is pre-configured, but disabled by default because Client registration is still required.

To register 3DM Publisher as Client of the Bentley IMS Access Provider, there are 2 options:

• Share your Application Location.
• Register your 3DM Publisher Server as Client with Bentley IMS, see https://developer.bentley.com

To register 3DM Publisher as Client of the Google Access Provider:

1. Manage your OAuth2 Credentials (for a Web Application) here: https://console.cloud.google.com/apis/credentials
2. Manage your Consent Screen configuration here: https://console.cloud.google.com/apis/credentials/consent

Additionally, Google requires its Clients to pass a secret.
Add the Client Secret to your Access Provider configuration for 3DM Publisher.

Access Provider configurations are managed from the Publisher Console's, System page.
Once configured and enabled, the 3DM Viewer automatically presents the Access Provider login option to the user.

• Code: Free of choice unique id of the Access Provider for 3DM Publisher
• Name: Free of choice name of Access Provider for 3DM Publisher
• OIDC Authority URL: The authority URL of the OpenID Connect Service, usually its domain.
• Client ID: The client-id of your 3DM Publisher Client provided by the OpenID Connect Service.
• Client Secret: The secret of your 3DM Publisher Client provided by the OpenID Connect Service (only required for Google).
• Login Button Label: Free of choice label of the 3DM Viewer sign-in button.

Implement SSO via Access Providers

• Example: Autologin to Publisher with Access Provider

Alternative options to achieve an auto-login or no login experience:

• Example: Bentley IMS Auto-Login to Cloud Publication
• Example: Bentley IMS Auto-Login to Publisher Publication