OK - OpenID Connect

The fulfillmenttools platform supports the OpenID Connect (OIDC) Protocol to support external IDPs.

Introduction

General documentation regarding OIDC can be found on the official OpenID Connect documentation. In general the OpenID Connect Protocol is supported by all major IDP's like Microsoft Entra ID (former Azure Active Directory / AD), Auth0, Keycloak etc.

All of the IDP's have in common that you need to create an OAuth Application which results in the following the data / credentials which you need to supply to the fulfillmentools platform:

• clientId

• clientSecret

• issuerUrl

• additional information might be needed (these have to be extracted from your IDP's documentation)

Furthermore, you need to configure groups and roles to enrich the auth token with role and group information. See the child pages for step by step guide for choosen IDPs.

Configure OIDC within fulfillmenttools

More OIDC-API information can be found here: REST API documentation - OIDC

To register an OIDC provider to the fulfillmenttools platform, you just need to execute the following REST API call:

POST https://{YOUR-TENANT-NAME}.api.fulfillmenttools.com/api/configurations/oidcproviders

{
    "name": "My Provider",
    "status": "ACTIVE",
    "clientId": "my client id",
    "clientSecret": "my client secret",
    "issuer": "https://my-oidc-issuer.com",
    "customParameters": [],
    "assignedGroups": []
}

Some IDP vendors need customParameters to make SSO work. See your IDP vendor's documentation for details.

Custom Parameters for Microsoft Entra ID / Azure Active Directory

Add this custom parameter in case you are using a Microsoft Entra ID / Azure Active Directory IDP to make sure, that only users of your tenant can login:

{
    ...
    "customParameters": [
        {
            "key": "your-tenant-name",
            "value": "your-azure-tenant-id"
        }
    ]
}

Mapping roles to fulfillmenttools facilities

We utilize the groups feature of your IDP to map users to facilities. In the OIDC configuration you can also provide assignedGroups. There you give an mapping from your IDP groupIds to fulfillmenttools facilityRefs:

{
    ...
    "assignedGroups": [
        {
            "group": "idp-group-id",
            "facilityRefs": [
                "fft-facility-id"
            ]
        }
    ]
}