Configuring an OpenID Connect Provider

The Operational Decision Manager servers are clients, or Relying Parties, of the OpenID Connect Provider. To use OpenID Connect in Operational Decision Manager, the OpenID Connect Provider must support certain features and be configured. The Relying Parties must be registered with specific parameters.

Grant types

The following table shows grant types that must be supported by the OpenID Connect Provider:

Grant type	Requirement	Description
Authorization code flow	Mandatory	The authorization code flow must be supported for the single sign-on (SSO) in the Operational Decision Manager web applications.
Password flow	Mandatory	The password flow must be supported. Decision Center and external API clients use this flow to obtain an access token for API invocation.
Refresh token flow	Mandatory	The refresh token must be activated to refresh access tokens.
Client credential flow	Optional	The client credentials flow can be supported optionally. The API invocation by the external clients might use this flow if the flow carries necessary claims on the groups, for example by using functional ID or groups.

Token formats and signature algorithms

Token format can be JSON Web Token (JWT) or opaque.

Signature algorithm can be HS256 or RS256.

OpenID Connect Provider endpoints

Notice all the URLs that are necessary, for example:

Authorization endpoint
Token endpoint
Introspection endpoint: For Operational Decision Manager APIs to introspect an access token and obtain claims.
Logout endpoint if logging out is supported.

Client registration

Provide the following information when you register Relying Parties in your OpenID Connect Provider.

Scope

In general, the scope is openid.

Client ID and client secret

Specify the client ID and client secret for your Operational Decision Manager application.

Redirect URI

The redirect URI section in your OpenID Connect Provider must contain several redirect URIs for Rule Designer to avoid having a conflict in the ports on the desktop that runs Rule Designer.

Attention: In hardened environments, the default use of 127.0.0.1 for the OpenID Connect (OIDC) callback URL might be blocked or restricted. You can override this behavior by using the system property com.ibm.rules.studio.openid.callbackEndpointHostname to specify a custom hostname.Ensure that the hostname you choose complies with your network security policies and is accepted by your OIDC provider. For example, you can map a custom hostname to 127.0.0.1 in your /etc/hosts file:

127.0.0.1   myhost.com

If you use this property, you must also set the callbackHttps property to false.

Examples of redirect URIs:

```
https://127.0.0.1:9081/oidcCallback
```
```
https://127.0.0.1:19081/oidcCallback
```
```
https://127.0.0.1:29081/oidcCallback
```
```
https://127.0.0.1:39081/oidcCallback
```

In these examples, 4 URLs are registered with 4 ports, so that you can use other ports when one of them is already used.

You must register your Operational Decision Manager application URL as the redirect URI. For example, if you enter https://myhost.mydomain.com:9444/decisioncenter in your browser to access Decision Center, your redirect URI looks like this:

https://myhost.mydomain.com:9444/oidcclient/redirect/<client_name>

Use HTTPS redirect URIs for more tightened security.

Token validity

You can configure 2 hours for the token validity. You can configure longer to cover a half-day or a day of work. You can verify your company's policies before you configure it.

Certificates

In general, an Operational Decision Manager server starts with a preconfigured server certificate. For more information, see the serverKeyAlias attribute in the tls-datasource.xml file in the <ODM_InstallDir>/shared/oidc directory. The hostname must match the certificate common name.

The truststore must contain the following certificates:

Certificate of the OpenID Connect Provider
Certificate of the Decision Center server. This certificate is used when Rule Designer connects to Decision Center.
Certificates of all servers of Rule Execution Server. These certificates are used when Rule Designer and Decision Center connects to Rule Execution Server.