Configuring OpenID Connect Authentication

Use OpenID Connect (OIDC) to authenticate LicensePredictor users through an OIDC-compatible identity provider. LicensePredictor uses the authorization code flow with PKCE for OIDC authentication.

Requirements

• Configured Authentication Settings with Provider set to Oidc
• OpenID Connect provider information and credentials:
  • Authority — The URL of the OIDC identity provider used for authentication and metadata discovery.
  • Client ID — The application (client) ID registered with the identity provider.
  • Client Secret — The secret generated for the app (store securely).
  • Scopes — The permissions and identity information requested from the identity provider. The default scopes are openid, profile, and email.

Configuring OpenID Connect Authentication

Follow these instructions to configure OpenID Connect Authentication Settings.

Step 1: Open the appsettings.json file

1. Navigate to the LicensePredictor directory.

   By default, this is located at: C:\Program Files\OpeniT\LicensePredictor

2. Open the appsettings.json file.

Step 2: Configure the OpenID Connect Authentication Settings

1. Locate the Oidc section under Authentication in the appsettings.json file.

2. Configure the OIDC provider information using one of the following settings:

   • Authority — Specify the OIDC provider authority used for discovery.

   • MetadataAddress — Specify the absolute URI of the OIDC metadata document. Use this setting to override discovery when the provider does not expose standard authority discovery.

     note

     Either Authority or MetadataAddress is required.

3. Fill in the OpenID Connect credentials on ClientId, and ClientSecret.

   note

   The client secret is required when Microsoft Entra ID authentication is enabled. Supply sensitive credentials through a secret store or environment override when applicable.

4. Configure the Scopes with the OIDC scopes to request. The default scopes are openid, profile,and email.

Other OpenID Connect Authentication Settings

Configure the OpenID Connect authentication behavior as needed:

Setting	Description	Default value
CallbackPath	Specify the endpoint that receives authorization-code responses.	/signin-oidc
SignedOutCallbackPath	Specify the endpoint that receives the post-logout response. Register the corresponding HTTPS callback URIs with the OIDC provider.	/signout-callback-oidc
RequireHttpsMetadata	Set to true to require HTTPS when retrieving provider metadata. Keep RequireHttpsMetadata set to true except in controlled local testing environments.	true
SaveTokens	Set to true to retain provider tokens after sign-in. Keep SaveTokens set to false unless the tokens are required after sign-in.	false
PushedAuthorizationBehavior	Specify how LicensePredictor uses pushed authorization requests (PAR). Accepted values are Disable, UseIfAvailable, and Require. Disable provides the broadest provider compatibility. Require only when the configured provider supports PAR.	Disable

OpenID Connect Authentication Behavior Settings

Configure the claims used by LicensePredictor:

Setting	Description	Default value
GetClaimsFromUserInfoEndpoint	Set to true to retrieve additional claims from the provider's UserInfo endpoint. Enable this setting only when the provider requires it and grants the scopes needed to retrieve the claims.	false
NameClaimType	Specify the claim used for the user's display name.	name
RoleClaimType	Specify the claim used for roles. Make sure NameClaimType and RoleClaimType match the claims returned by the configured OIDC provider.	roles

OpenID Connect Authentication Claim Settings

Example: appsettings.json

"Oidc": {
  "Authority": "https://login.organization.com",
  "MetadataAddress": "",
  "ClientId": "9f8e7d6c-5b4a-3210-fedc-ba0987654321",
  "ClientSecret": "V~*************************************************",
  "CallbackPath": "/signin-oidc",
  "SignedOutCallbackPath": "/signout-callback-oidc",
  "RequireHttpsMetadata": true,
  "GetClaimsFromUserInfoEndpoint": false,
  "NameClaimType": "name",
  "RoleClaimType": "roles",
  "SaveTokens": false,
  "PushedAuthorizationBehavior": "Disable",
  "Scopes": [
    "openid",
    "profile",
    "email"
  ]

5. Save the changes.

Step 3: Restart the LicensePredictor Service

1. Open Task Manager.

2. Under Services, restart the OpeniTLicensePredictor service.