OIDC is an alternative authentication protocol for Single Sign-On (SSO) built around OAuth2. If an app can authenticate as an Asset Bank user to access the API, the same principle can be applied to give users access in their web browser. OIDC can be used alongside other SSO methods and traditional username/password logins.

Considerations

Username mappings

Asset Bank users are defined by their username, so they must be unique. Therefore, we map the 'Subject' claim from your SSO IdP to the Asset Bank username, as 'Subject' is also unique. That means that if a user's 'Subject' claim does not exactly match their Asset Bank username, a new account will be created for them instead of logging them in to their existing account.

Remote group mappings

Please check that your 'Subject' claim matches the existing Asset Bank usernames before enabling your OIDC integration. If it does not, please talk to our Customer Support Team to discuss your options.

For those using Microsoft Entra, there is no 'groups' scope to pass to Asset Bank. Therefore, additional configuration is required to set up Remote Group Mappings.

Enabling OIDC

At this time, OIDC is not available by default. Please contact our Customer Support Team to access this feature. Once available, you will find the OIDC settings in the Admin Config > System > SSO area of Asset Bank.

If you currently use our SAML2.0 SSO integration, you can configure OIDC alongside it without interrupting user access. Please be aware that enabling OIDC will not remove the existing SAML2.0 login option from the login page. To do so, edit the 'Login page copy' content item in the Admin Config > Content area of Asset Bank, or contact our Customer Support Team.

Once configured, you can test the new OIDC login before enabling it for your users by visiting https://<your-base-url>/action/ssoAuthenticate?mode=manual, replacing <your-base-url> with your app's base URL. For example: 

https://example.assetbank.app/assetbank-example/action/ssoAuthenticate?mode=manual

Once you've tested the login, you can enable it for your users, which will add a 'Login using SSO' option to your login page.

Guides

We currently have step-by-step guides for configuring OIDC with Microsoft Entra and Okta. For other IdPs, the Okta guide should provide all the relevant information.

• Microsoft Entra
• Okta