Set up OpenId Connect SSO

You can use OpenId Connect SSO as an identity layer on top of the OAuth 2.0 protocol. This allows you to verify user identities based on the authentication performed by an Authorization Server.

Login via OpenId Connect is enabled by changing the relevant settings in the Admin Console. Changes to these settings will not take affect until after the application pool is recycled.

Enable OpenId Connect SSO

1. Go to Administration > System > Settings in the Admin Console.
2. Search for Allow Sign in With OpenId Connect.
3. Set the Allow Sign in With OpenId Connect toggle to YES. If Yes, an OpenId Connect button will appear on the sign in page. Default value: No.
4. Set the Use OpenId Connect Sign In on Storefront toggle to YES, if you want to enable this. If Yes, an OpenId Connect button will appear on the storefront sign in page. Default value: No.
5. Set the Use OpenId Connect Sign In on Admin Console to YES, if you want to enable this. If Yes, an OpenId Connect button will appear on the admin console sign in page. Default value: No.
6. Enter an OpenId Connect Caption. This is the caption to show on the OpenId Connect button. Default value: OpenIdConnect.
7. Enter your OpenId Connect Client ID. The client ID identified by your OpenId Connect application used for OpenId Connect login.
8. Enter your OpenId Connect Client Secret. The Client Secret identified by your OpenId Connect application used for OpenId Connect login. Leave this blank if it's not required.
9. Enter you OpenId Connect Authority URL. The Authority URL of your OpenId Connect application.
10. Set the OpenId Connect Requires Nonce toggle to NO, or false, if your OpenId Connect provider does not support nonce. Default value: Yes.
11. Click Save.

📘

Note

If you plan on using SSO for the Admin Console and you do not wish to automatically assign any permissions, you should update the Assign A/C User Role with SSO setting to NO.  New Admin Console users will then require an existing user to set their roles up manually. Default value: Yes.

Configure the SSO Clients

1. Go to Administration > Permissions > Single Sign On in the Admin Console.
2. Click Edit for the ext client to use OpenID Connect for the storefront. Enter your website URLs in the Redirect Uris (comma separated list of redirect URIs). These have to use the path /identity/externalcallback, such as https://www.b2bcommercesite1.com/identity/externalcallback, https://www.b2bcommercesite2.com/identity/externalcallback, and so on. Click Save.
3. Click Edit for the isc_admin_ext client to use OpenID Connect for the Admin Console. Enter your website URLs in the Redirect Uris (comma separated list of redirect URIs). These have to use the path /identity/adminexternalcallback, such as https://www.b2bcommercesite1.com/identity/adminexternalcallback, https://www.b2bcommercesite2.com/identity/adminexternalcallback, and so on. Click Save.

Enable the Use Authorization Code Flow setting

This global setting is only available to ISC_System and ISC_Implementer and is hidden unless Allow Sign in With OpenId Connect is toggled to Yes.

1. Go to Administration > Settings > Site Configurations > Openid Connect SSO in the Admin Console.
2. Toggle Use the Authorization Code Flow instead of the Hybrid Flow to Yes if your OpenId Connect provider does not support the Hybrid Flow (AWS Cognito).

Additional extension points

Settings

There are now settings for Scopes and ResponseTypes that have default values of openid profile email for Scopes and code id_token for ResponseTypes. You can change these values if you need to for your IDP.

Plugins

1. Implement IInjectOidcFactoryStartup which passes you the IdentityServerServiceFactory to make any changes or additional configurations.
2. Implement IInjectOidcSecurityTokenValidated to inject logic into the Security Token Validated event.