Stages Documentation

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
262:integration:oidc [2026/10/28 12:06] – Policnik, Florian262:integration:oidc [2026/10/28 12:19] (current) – Policnik, Florian
Line 38: Line 38:
  
 <code xml> <code xml>
-<method type="Oidc" name="oidc-idp" enabled="${idp.oidc.enabled}"><!-- TODO -->+<method type="Oidc" name="oidc-idp" enabled="${idp.oidc.enabled}">
     <properties>     <properties>
         <property name="discoveryURI" value="${idp.oidc.discovery.url}" />         <property name="discoveryURI" value="${idp.oidc.discovery.url}" />
Line 59: Line 59:
 </code> </code>
  
-The ''discoveryURI'' points to the OIDC provider's discovery document. The ''scope'' determines which claims are requested. Set ''clientAuthenticationMethodAsString'' to a client authentication method supported by both Stages and your provider.+The ''discoveryURI'' points to the OIDC provider's discovery document. The ''scope'' determines which claims are requested.
  
 The following example configuration variables are referenced above. Adjust the discovery URL, scope, client ID, and client authentication method to match your provider's client registration. The following example configuration variables are referenced above. Adjust the discovery URL, scope, client ID, and client authentication method to match your provider's client registration.
Line 82: Line 82:
 </code> </code>
  
- +After you have configured the OIDC authentication method in ''config.xml'', update the configuration via ''stages update'' and restart the Stages service.
-After you configured the service provider and identity provider in ''config.xml'', update the configuration via "stages update'' and restart the Stages service.'' +
  
 ===== Changing the license pool and license type for existing users ===== ===== Changing the license pool and license type for existing users =====
  
-By default, existing users are not modified by the OIDC authentication process when the OIDC configuration was changed after the user had been created. However, you can set the ''forceLicensePoolReassignment''  attribute on an ''attribute-match'' to ''true'' if you want changes of the ''licensePoolIdent''  or ''defaultLicenseType''  attributes to be applied to existing users.+By default, existing users are not modified by the OIDC authentication process when the OIDC configuration was changed after the user had been created. However, you can set the ''forceLicensePoolReassignment'' attribute on an ''attribute-match'' to ''true'' if you want changes of the ''licensePoolIdent'' or ''defaultLicenseType'' attributes to be applied to existing users.
  
  
 ===== Configuring Stages attributes in default-matcher section with JavaScript ===== ===== Configuring Stages attributes in default-matcher section with JavaScript =====
  
-JavaScript control flow statements (e.g. "if","switch") can be used to configure values for Stages attributes. All claims of the OIDC response are accessible as variables and can be used in the JavaScript expression  +JavaScript control flow statements (e.g. ''if'', ''switch'') can be used to configure values for Stages attributes. All claims of the OIDC response are accessible as variables and can be used in the JavaScript expression.
  
 JavaScript expressions can be used with the following Stages attributes: JavaScript expressions can be used with the following Stages attributes:
Line 102: Line 100:
 **General JavaScript expression notation:**   **General JavaScript expression notation:**  
  
-<code javascript> <Stages_attribute>="=<JavaScript_expression>"  +<code xml> 
 +<Stages_attribute>="=<JavaScript_expression>"
 </code>   </code>  
  
 **JavaScript notation of if-clauses:** **JavaScript notation of if-clauses:**
-<code javascript> if (condition1) 'returnValue1'; else if (condition2) 'returnValue2'; else if (condition3) 'returnValue3'; else 'returnValue4';  +<code javascript> 
 +if (condition1) 'returnValue1'; else if (condition2) 'returnValue2'; else if (condition3) 'returnValue3'; else 'returnValue4';
 </code>   </code>  
  
 **JavaScript notation of value conditions:** **JavaScript notation of value conditions:**
  
-OIDC claims that are defined via identity_provider_attribute elements can be used in these scripts. E.g.  +OIDC claims that are defined via identity-provider-attribute elements can be used in these scripts. E.g.  
 <code xml>  <code xml> 
 <identity-provider-attribute name="email" id="<EMailAddress>" />   <identity-provider-attribute name="email" id="<EMailAddress>" />  
Line 127: Line 127:
  
 This example creates Stages users with the following conditions: This example creates Stages users with the following conditions:
-  * The pattern matches the entry of the OIDC claim "id".    +  * The pattern matches the entry of the OIDC claim ''id'' 
-  * Depending on the users' email address (domain-part), OIDC claim "email" is used to assign different values for defaultRolesUsername, defaultLicenseType and licensePoolIdent +  * Depending on the users' email address (domain-part), OIDC claim ''email'' is used to assign different values for defaultRolesUsername, defaultLicenseType and licensePoolIdent
  
 <code xml>  <code xml> 
Line 147: Line 147:
  
 Please note that the values of multi value attributes are provided to the scripts as one value as a comma separated string. Please note that the values of multi value attributes are provided to the scripts as one value as a comma separated string.
- 
  
  
Line 167: Line 166:
  
 This will create a SSO button on the login page for each IDP. This will create a SSO button on the login page for each IDP.
-Please provide a user understandable naming by defining a translation property for each login.sso.[name] propertyin each supported language:+Please provide a user understandable naming by defining a translation property for each login.sso.[name] property in each supported language:
 ''conf/local.properties'', ''conf/local_de.properties'', ... ''conf/local.properties'', ''conf/local_de.properties'', ...
 <code properties> <code properties>