Manage OpenID providers

In this document, you will find a step-by-step guide on how to add or remove OpenID providers in Segura™.

Access path

1. In Segura™, on the navigation bar, hover over the Products Menu and select Settings.
2. In the side menu, select Authentication > OpenID > Providers.

Add provider

1. On the Providers report page, click the Add button.

2. On the Provider registration screen:

   • Type: in the drop-down menu, select the type of OpenID provider to be used.
   • Enable: enable or disable the OpenID provider at the time of creation.
   • Environment: select the environment in which the OpenID provider will be used.
   • Provider Name: name of the provider to be registered.
   • Icon (jpg or png – maximum 200kb): upload area for your custom provider icon.
   • Client ID: enter the client ID for the connection. This ID is provided by the OpenID provider when registering a new application.
   • Client secret: enter the secret from the OpenID authentication provider. This secret is provided by the OpenID provider when registering a new application.
   • Preferred username: enter the OpenID attribute that will be used as the user identifier, such as email.
   • Domain or public IP for URL Redirection: enter Segura™’s domain or public IP address. It is used by the OpenID provider to redirect the user back to your application after authentication.
   • Redirect URL: enter the specific endpoint in your application to which the OpenID provider will redirect the user after authentication.
   • Comments: field for adding notes or additional observations about the configuration.

3. In the Endpoint configuration section:

   • OpenID endpoint configuration: enter the endpoint that configures OpenID. This is the base URL provided by the OpenID provider. This URL describes the necessary endpoints for OpenID interactions. This configuration automates the general discovery of endpoints.

4. In the URLs of other endpoints section:

   • Authorization endpoint: enter the URL provided by the OpenID provider, used by the application to send authorization requests.
   • Token endpoint: enter the URL provided by the OpenID provider, to which the application sends requests to exchange the authorization code for an access token.
   • Userinfo endpoint: enter the URL provided by the OpenID provider, through which the application can request authenticated user profile information using the access token.

5. In the Extra configurations for provider section:

   • JWK endpoint (mandatory if it is not in the main openid endpoint): enter the endpoint where the application should obtain the OpenID provider’s public keys to validate the access token signature. This field is mandatory if these keys are not available in the OpenID configuration endpoint.
   • Additional Issuers (separated by commas): enter the list of additional issuers accepted by the application. Useful when the application needs to support multiple OpenID providers.

6. Optional: configure the Authorization configuration by device section to let users sign in to Terminal Proxy and RDP Proxy through this provider from a second device. For how the flow works, see Device authorization.

   • Enable device authorization: enable device authorization for this provider.
   • Client ID for Device Authorization: enter the client ID of the application registered for device authorization. Leave it empty to use the provider's Client ID.
   • Client Secret for Device Authorization: enter the client secret of that application. Leave it empty to use the provider's Client secret.
   • Device Authorization Endpoint: enter the device authorization endpoint URL of the identity provider.
   • Token Endpoint URL: enter the token endpoint URL of the identity provider.
   • User information endpoint URL: enter the user information endpoint URL of the identity provider.

   Segura™ requires the client ID, the client secret, and the 3 endpoints when device authorization is enabled on an active provider with the Local environment. If one is missing, Segura™ does not save the provider and shows a message that lists the required fields.

   Device authorization uses only active providers with the Local environment. A provider with the Domum Remote Access environment is never used.

   Device authorization uses one provider only. If more than one active Local provider has it enabled, Segura™ warns you when you save and names the provider in use.

   Device authorization identifies the user by comparing the value of the claim set in Preferred username with the Segura™ username of an active user. For Microsoft Entra ID accounts without an email address, set Preferred username to preferred_username. Then make the Segura™ username match the user principal name (UPN).

   Attention

   When device authorization is enabled and working, Terminal Proxy and RDP Proxy ask every client user to sign in through it, including local users. Database Proxy does not use device authorization. Sessions that you open from the Segura™ web portal use the web portal sign-in. If device authorization is disabled or cannot start, the proxies return to username and password sign-in with Segura™ MFA. Segura™ has validated device authorization with Microsoft Entra ID.

7. Click Save.

Update provider

To update the information of a previously registered provider, follow these steps:

1. In Segura™, on the navigation bar, hover over the Products Menu and select Settings.
2. In the side menu, select Authentication > OpenID > Providers.
3. In the Providers report, find the record you want to update, click the Actions button, and select Edit.
4. Update the necessary information and click Save.

View provider details

To view provider details, follow these steps:

1. In the Providers report, find the record you want to update, click the Actions button, and select Provider details.
2. The Provider registration window will open in view-only mode.
3. You can view various details of the registered provider in this window, such as: OpenID endpoint configuration, Authorization Endpoint, Userinfo Endpoint, Redirect URL, Token Endpoint, and Comments.
4. To view information individually, click the eye icon next to the text field of each detail.

Delete a provider

1. In the Providers report, find the record you want to update, click the Actions button, and select Deactivate.
2. In the confirmation modal, click Yes to deactivate the provider.