Identity Providers Configuration

Name* (string input):
Enter a meaningful identity provider name.

Provider metadata URL* (string input):
Enter the OpenID Connect provider metadata URL.

OIDC Client Credentials* (string select):
Select Login credentials with the OpenID Connect target, containing the client ID as login and the client secret as password. The client ID and client secret are generated on the OpenID Connect IDP when setting up a new application (Horizon). Credentials can also be created on the go from this field.

Scope* (string input):
Scope used by Horizon during authentication on the identity provider to authorize access to user’s details.

Proxy (string select):
Proxy used to access Provider metadata URL, if any.

Timeout* (finite duration):
Timeout used for authentication on the identity provider. Must be a valid finite duration. By default 10 seconds.

Identifier Claim* (string input):
Dynamic expression defining how to construct the identifier from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user identifier is contained in the login claim, then the configured value should be {{login}}.

Email Claim* (string input):
Dynamic expression defining how to construct the user email from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user email is contained in the 'email' claim, then the configured value should be {{email}}. If the email is not available directly from the claims but can be computed from the 'login' claim by appending a domain, the configured value should be {{login}}@evertrust.fr.

Name Claim* (string input):
Dynamic expression defining how to construct the username from the OpenID Connect claims. Claim names must be declared between {{ and }} characters. For example, if the user name must be constructed as family name, given name and family name is available in the family_name claim, given name is available in the given_name claim, then the configured value should be {{family_name}}, {{given_name}}.

ID Token Signature Algorithm (string select):
Algorithm used by the OpenID Connect provider to sign ID tokens, as defined when registering Horizon on the provider. If not set, Horizon accepts the algorithms advertised in the id_token_signing_alg_values_supported provider metadata.

User Info Signature Algorithm (string select):
Algorithm used by the OpenID Connect provider to sign User Info responses returned as JWT. If not set, Horizon accepts the algorithms advertised in the userinfo_signing_alg_values_supported provider metadata.

Trust system CAs (boolean):
If enabled, the system trust store is used, in addition to the Certification Authorities trusted for server authentication in Horizon, to verify the server certificate of the provider metadata endpoint. Otherwise, only these Certification Authorities are trusted. Enabled by default.

Authentication parameters (list of parameter → value):
Additional parameters added to the authentication request sent to the OpenID Connect provider. For example, add the acr_values parameter with a value supported by the provider to request a higher authentication level.

Enable (boolean):
Enable/Disable the identity provider.

Enable on UI (boolean):
Enable/Disable the identity provider on user interface.

Language* (select):
Select a language. Supported languages are:

Display Name (string input):
Enter a display name. This will be the localized name of the provider on the login page.

Description (string input):
Enter a description. This will be displayed in a tooltip when the provider is chosen on the login page.