OpenID Connect

1. Configure the Data Insight instance, add section oidc, and save the changes.
   Note: By adding the section oidc to the spec, it will enable OpenID configuration.

   
   spec:
     oidc:
       enableRedirect: true
       authority: "https://auth.example.com/sso"
       clientId: "datainsight"
       clientSecret: "secret"
   

   Important: Update the property values with those specific to OpenID Connect (OIDC) authentication source.

   Property Name	Value Type	Example	Default	Description
   enableRedirect	boolean	true	false	Whether to redirect when not authenticated (usually true).
   enableSignout	boolean	true	false	Redirect the user to the OIDC provider's end_session_endpoint when signing out of DI. Default: false
   authority	string URL	https://auth.example.com/sso		(required) OIDC discovery URL defined by RFC 8414. For example, "https://<SevOne NMS appliance>/sso".
   clientId	string	"datainsight"		Required: The client identifier of the relying party at the provider.
   clientSecret	string	“s2gR2wGwvnF4rikxnwxR”		Client secret of the relying party at the provider. Optional if response_type = "id_token"
   responseType	enumeration	“code”	"code"	Type of response. Either “code” for Authorization Code flow or “id_token” for Implicit flow defined in RFC 6749.
   scope	string	“openid profile groups”	“openid profile groups”	Requested OAuth2 scopes. “groups” is only for multi-tenant.
   groupPrefix	string	“sevonetenant:”		(optional with a single tenant) A group claim prefixed with this determines the tenant.
   encryption	enumeration	"A256GCM"		(optional) ID Token Encryption Content Encryption Algorithm. Should match the algorithm used by the OIDC provider to encrypt id_token. Options are A128CBC-HS256 A192CBC-HS384 A256CBC-HS512 A128GCM A192GCM A256GCM

2. Optionally, wait for the configuration to be applied.

   
   kubectl wait datainsight di --for condition=Successful
   

The properties listed above are standard OpenID Connect configuration values, with the exception of groupPrefix. The groupPrefix property is used to help determine which tenant is used for login. If the provider provides a groups claim (as an array of strings), and the groupPrefix is defined, then the user will be logged in using the first value in the claim that has this prefix (with the prefix removed).

Example

A groups claim of [“tenant:Test1”, “example2”] will login with the tenant Test1, if the groupPrefix property is set to tenant:.

1. Ensure the SevOne NMS dex setup is working. Please refer to SevOne SAML Single Sign-On Setup Guide for details.
2. Create a new static client for SevOne Data Insight with a unique ID. This ID will be used as the clientId when configuring SevOne Data Insight.
3. Ensure the redirectURIs for SevOne Data Insight static client point to https://<IP address or hostname for SevOne Data Insight>/callback.

   Example: Configuration

   staticClients:
   - id: sevonedatainsight
     redirectURIs:
     - 'https://10.10.10.10/callback'
     name: 'SevOne DI'
     secret: Uhy6g7CyTALSIrwsnEYNBF60ZM0eeHQkZCqIoXBrPOoiZjJANcNZb7CJGB8wGDrE1sGbM9pdIzSJ0OL0PfyNXeg9Uih7F9FNdTaVyxMw8evFtcq4L7z71IuBJ08V4rRH
     samlInitiated:
       redirectURI: https://10.10.10.10/callback

As with all SevOne Data Insight tenants that have multiple datasources, the username extracted from the OIDC provider must have a user present on every NMS Datasource that is part of the tenant.

1. If the Single Sign-On provider does not have the user's login stored under name, Configure the Data Insight instance, set the following environment variable, OIDC_NAME_CLAIM, to allow SevOne Data Insight to use another field in the JWT to determine the user's login name and then, save it.

   Example: Configuration

   
   spec:
     graphql:
       env:
         OIDC_NAME_CLAIM: email
   

   Save the config.

2. Optionally, wait for the configuration to be applied.

   
   kubectl wait datainsight di --for condition=Successful
   

1. If the OpenID Provider is served with a certificate signed by a custom Certificate Authority (CA), it must be provided to SevOne Data Insight for secure connections. Configure the Data Insight instance, add the CA to the additionalCas list and then, save it.
   Note: The OpenID provider must serve the full certificate chain to trust the certificate and have a Subject Alternative Name (SAN) with the host provided to SevOne Data Insight. Common Name (CN) is no longer supported.
   Note: The additional CA(s) must be provided in pem format.

   
   spec:
     additionalCas:
       - |
         -----BEGIN CERTIFICATE-----
         ...
         -----END CERTIFICATE-----
   

2. Optionally, wait for the configuration to be applied.

   
   kubectl wait datainsight di --for condition=Successful
   

1. If desired, for id_token to be encrypted when retrieved by SevOne Data Insight, the OIDC provider must be configured with SevOne Data Insight's encryption public key which can be retrieved from /api/v1/oidc/.well-known/jwks.json. There will be two JSON web keys in the JSON Web Key Set. The one with "use": "enc" is the one which should be used for encryption.
2. The OIDC provider client must agree with SevOne Data Insight's configuration for ID Token Encryption Key Management Algorithm and ID Token Encryption Content Encryption Algorithm.
   1. ID Token Encryption Key Management Algorithm by default is RSA-OAEP
   2. ID Token Encryption Content Encryption Algorithm must be provided by the administrator to inform SevOne Data Insight that ID Token Encryption is configured by the oidc.encryption variable as defined in Enable OpenID Connect above.