Configure OpenID Connect for a SaaS application

Learn to configure OpenID Connect parameters for a custom SaaS application.

You can add a SaaS application that uses the OpenID Connect protocol. This process allows EAA to act as an OpenID provider or the identity provider that authenticates the user to the SaaS application.

When configuring this application in EAA, a redirect URI is required from the application (relying party). The redirect URI is where authentication responses are sent and received by the application. In the application, this also may be called the redirect URL or the callback URL.

The application (relying party) requires the following information from EAA:
  • Discovery URL: This URL is automatically generated and based on the hostname of your identity provider. This page contains all the OpenID configuration endpoints and is formatted with the following URL: https://<idp-hostname>/.well-known/openid-configuration, where <idp-hostname> is the hostname of the Akamai identity provider. You provide this URL in the application to allow the app to discover the endpoints of your configuration.

    If the application does not discover this URL automatically, you can download the metadata JSON file with the necessary endpoints and upload this file into the application. If an upload option is not available for this metadata, you must configure the application with the individual elements that are defined in the metadata JSON file.

  • Client ID. Unique ID generated for the application.
  • Client Secret. The secret that is used along with the client ID for authentication. In the authentication flow, two client secrets (the new and previous key) are available for use to support client secret rotation.
  • Claims: Claims define the information that is required to identify and authenticate the user.
Note: Field names or labels for an OpenID Connect configuration may vary in the application or relying party.

How to

  1. Log in to the Enterprise Application Access (EAA) Management Portal.
  2. From the top menu bar click Applications.
  3. Click Add application. Under Add Custom Apps, click SaaS app.
  4. Enter a name and description for the application.
  5. In the Protocol menu, select OpenID Connect 1.0, and click Create App and Configure.
  6. Complete the General settings:
    1. To add an application icon, click Add and select from the provided icons or upload an icon.
    2. If you want to organize the application in a category on the Login Portal, select a category. Otherwise, leave the selected category as Uncategorized.
    3. If you want to hide the application from the Login Portal, select Hide Application from Login Portal.
    4. In the Application URL, enter the URL of the application.
    5. Click Save and go to Authentication.
  7. Complete the Authentication settings:
    1. Click Assign identity provider, and in the dialog, select an Akamai identity provider.
    2. Click Assign directory, and select a directory.
    3. Click Save and go to OpenID settings.
  8. Copy the Discovery URL. The Discovery URL is automatically generated. If your application does not automatically fetch metadata, you can copy or download this file from EAA. Click View to view this data or click Download to download the metadata file.
    Note: In the application, you must provide this URL as the provider URL or upload the metadata file. If the application does not allow you to provide the URL or upload the metadata file, you may need to configure the application with the individual elements that are defined in the file.
  9. In the Relying Party Settings:
    1. Copy the Client ID.
    2. Copy the Client Secret to a secure location.
    3. If you need to rotate the secret, click Rotate client secret. Copy the secret to a secure location and update the application with the new secret.
    4. Enter this information into the application (relying party).
    5. In the Redirect URI field, enter the redirect or callback URL from your application. This field is required. Click Add More to enter more URIs.
    6. If you are using an implicit authentication flow for OpenID Connect, select Implicit Grant.
    7. To configure JavaScript origins for an implicit authentication flow, in the Javascript Origins field, enter the URL or URLs of the origin that serves the JavaScripts responsible for sending cross-origin resource sharing (CORS) requests to token or user info endpoints.
    8. If you want to disable the logout that is initiated by the identity provider, disable the Front channel logout session required option.
    9. If the front channel logout session setting is enabled, in the Front channel logout-URI(s) field, enter a URI or URL to support this feature. Click Add More to enter more URIs. The scheme, protocol, and port of the front channel URI must match one of the configured redirect URIs.
    10. To configure post logout redirect URI(s), enter the URI where the OpenID provider sends logout responses to logout requests.
    11. To enable proof key for code exchange (PKCE), select PKCE.
    12. Ensure Include claims in id_token is enabled.
    13. To view or download the metadata for the client, click View or Download.
  10. To add a claim:
    1. Click Add More.
    2. Select a Scope.

      If you select Custom Scope, a field appears where you can enter a value.

    3. Select a Claim Name based on the scope you selected or specified.

      If you select Custom, a field appears where you can enter a name.

    4. Select a Value.

      If you select Custom Script or Fixed Value, you must enter data in the provided field.

    5. To add more scopes, repeat steps 10a to 10d.
  11. Click Save and return to Deployment.
  12. Deploy the application.

Next steps

Ensure that you configure the application (relying party) with the Discovery URL or the JSON metadata file information, and the client ID and secret.