Federate IdP with OIDC IdP

OIDC(Open Id Connect) is an open authentication protocol that enables users to sign in to multiple applications using a single set of credentials.

If you've already developed applications using your own OIDC Identity Provider (IdP), you can federate this IdP with the one provided by the SiX IDaaS & IAM Identity Application. By enabling authentication federation, users can log into your new application using their existing OIDC IdP credentials, while authorization can be centrally managed through the IAM system within the SiX IDaaS & IAM workspace.

Enhanced Security

After federation, your IdP user will benefit from MFA, personal information sharing consent control, more at: Overview of Data Security & Privacy

Delegated Authentication

Authentication federation refers to authentication delegation. After the Identity Provider (IdP) in the SiX IDaaS & IAM tenancy receives the authentication request, it delegates the request to the existing OIDC IdP.

Steps to federate IdP with OIDC IdP

1. Create an SiX IDaaS & IAM IdP(identity application)

On SiX IDaaS & IAM console, go to "Authentication -> Create Identity Application" to create an IdP(identity application), change the "Authentication Sources:" to "OIDC authentication source(identity provider)".

2. Set the federated IdP "OIDC/OAuth2 client" parameters

Set the federated IdP "OIDC/OAuth2 client" parameters as "Client ID", "Client Secret" etc.

Note

Currently only support to parse the ID Token and Access Token in JWT format!

Note

Please ensure to set the "authorization code" callback URL of the federating IDP to federated IDP, Url is: “https://{appDomain}/oidc/sso/callback”！

3. Create an OAuth2 Client and associate it with IdP

Creaate an OAuth2 Client on the SiX IDaaS & IAM console and associate it with IdP(identity application).

Create IdP for SPA

4. Use the OAuth2 Client in your application

Apply the OAuth2 Client information in your application to initiate the authentication process, when the authentication process is triggered, SiX IDaaS & IAM will handle the authentication federation process automatically.

5. Your application get ID information and associate it with your local user ID

You can get the IdP "openId" and the ID of federated OIDC provider user through parsing JWT and use /userinfo endpoint.

TIP

A sample access token with "openId" and federated attributes(including the federated IDP user id) highlighted!

{
  "sub": "abceft@six-inno.cn",
  "role": [
    {
      "ROLE_iam-iot-product-key": [
        "iam_config_read",
        "iam_key_create",
        "iam_keys_read",
        "iam_key_update"
      ]
    },
    {
      "ROLE_iam-iot-app-edit": [
        "iam_app_update",
        "iam_app_create",
        "iam_app__client__link_remove"
      ]
    },
    {
      "ROLE_iam-iot-product-edit": [
        "iam_iot__product__props_create",
        "iam_iot__product_update",
        "iam_iot__product__topic_delete",
        "iam_iot__product__topic_create",
        "iam_iot__product_delete",
        "iam_iot__product_create"
      ]
    },
    {
      "ROLE_iam-iot-device": [
        "iam_iot__device__mqttmsgs_read",
        "iam_iot__analysis_deviceMsg",
        "iam_iot__device__statuses_read",
        "iam_iot__device__info_bindings",
        "iam_iot__device__info_acls",
        "iam_iot__device_bind",
        "iam_iot__analysis_activeDevice"
      ]
    },
    {
      "ROLE_iam-iot-product-read": [
        "iam_iot__product_read",
        "iam_iot__products_read"
      ]
    },
    {
      "ROLE_iam-iot-app-read": [
        "iam_app__clients_read",
        "iam_app_read",
        "iam_app__users_read",
        "iam_apps_read"
      ]
    },
    {
      "ROLE_iam-iot-client-read": [
        "iam_clients_read"
      ]
    },
    {
      "ROLE_iam-device": [
        "iam_device_read",
        "iam_devices_read",
        "iam_device_registration",
        "iam_device__guid_read",
        "iam_device_provision"
      ]
    },
    {
      "ROLE_iam-iot-config-read": [
        "iam_iot__config_read"
      ]
    },
    {
      "ROLE_iam-iot-client-edit": [
        "iam_client__app_create",
        "iam_client_create",
        "iam_client_update"
      ]
    }
  ],
  "org": {
    "level": 1,
    "orgId": "c0a81f4c-91a8-1e4f-8191-a82e66b50000"
  },
  "openId": "ac1e2001-976d-15de-8197-6d181c780001",
  "iss": "http://127.0.0.1:9001",
  "aud": "iot_sample_client",
  "nbf": 1749957697,
  "federate": [
    {
      "name": "oidcAuthn",
      "value": "{\"access_token\":\"eyJraWQiOiJiYmQ4ZDg0NS0yZTY0LTQxYzQtYTk4NC03Mjg0OWY2OTI1NzIiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzZXJ2aWNlQHNpeC1pbm5vLmNuIiwiYXVkIjoiaW90X3NhbXBsZV9jbGllbnQiLCJuYmYiOjE3NDk5NTc2OTIsInJvbGUiOltdLCJvcmciOnsibGV2ZWwiOjAsIm9yZ0lkIjoiMGEyYTAwOTMtOGJmNi0xZGRhLTgxOGItZjY0ZTAyMDgwMDAwIn0sIm9wZW5JZCI6IjBhMmEwMGIxLTk2MzQtMTM4MS04MTk2LTM0NWM4NmExMDAwZCIsInNjb3BlIjpbIm9wZW5pZCJdLCJpc3MiOiJodHRwczovLzA4ZDdkYi5hcHAuc2h1aGVuZ2xpYW5jaGFuZy5jb20iLCJleHAiOjE3NDk5NzU2OTIsImlhdCI6MTc0OTk1NzY5MiwianRpIjoiNzEwMDg1NDQtNGRiYS00YTBkLTk3M2ItNjIzMTk1YTExMzE4In0.p10AbEsp5PZyeewQHa2q73rGEt9pr_Z553tzp3ofKQ7aCYGYcR4PU4uleEikKwrNkPWvvPkJf9CDEGHHcv0jrIDVb2LdU6W8AloxP_FEgJZyS1KaxrXAGUs7h1Dj2OhPafW5hc3xy7e8QiMG1NmPXCVTB_x0hc0HmsNc2LDxpjrsyNc1FHnXIDh4IrkowGgJSG-XpPca3n3C11iiS3j6KgEue0No1Ozbh-OYYNvKAa0_DHAWKEvZBEm80LntutMTAmW6eYPNpappmvgZKFq6Zo0xzn0pEJBPJdQQmH36yRaJsCc9WCKuCcPlltvKltz0IjDWpmZbMAfJDJMZyjctAg\",\"scope\":\"openid\",\"id_token\":\"eyJraWQiOiJiYmQ4ZDg0NS0yZTY0LTQxYzQtYTk4NC03Mjg0OWY2OTI1NzIiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzZXJ2aWNlQHNpeC1pbm5vLmNuIiwiYXVkIjoiaW90X3NhbXBsZV9jbGllbnQiLCJhenAiOiJpb3Rfc2FtcGxlX2NsaWVudCIsImF1dGhfdGltZSI6MTc0OTk1NzY5MSwiaXNzIjoiaHR0cHM6Ly8wOGQ3ZGIuYXBwLnNodWhlbmdsaWFuY2hhbmcuY29tIiwiZXhwIjoxNzQ5OTU5NDkyLCJpYXQiOjE3NDk5NTc2OTIsImp0aSI6ImU2YTQxNWQyLWI5ZmMtNDViZi05MzIwLTlkMjlhYjBmOTFlNiIsInNpZCI6InZkRGY2WWhtOWJTWHdZcVFqdjVwQXBjcHQ3OTFrM1JrcTkxZGFBZEs2V0UifQ.iYcI2BjwQo8msWgNxlghwQS3L8QG0kGvZHVXHeSEjgBRimeYEiT0AWXUxvr_xQNZ3FUD03a1taY_X1vTCiEauaN68pur2cpSRRNxJj1RKPMlMgmKd1xwv5bjiJNdigtsbl9MxCm6U9DqYvQgMMfSV61OJWD_aYagpMAQxAV8qmtInul7wtVyxbYWBpPJYmrsJCM-oYvdAN-6qzL6V8t5VxFTAHiWBQkze6YCoWkmXSi23ssINkg6HIpWFFgsolXtnYnfeQQWMbFo9rTlFaNGtnJqPqdyj5TfaF7tLL5pAZe3l42cXpID2ioKyoU6GTHYC6mGEoclXKbmSfBWojm9tQ\",\"token_type\":\"Bearer\",\"expires_in\":17999}"
    },
    {
      "name": "sourceUserId",
      "value": "0a2a00b1-9634-1381-8196-345c86a1000d"
    }
  ],
  "scope": [
    "openid",
    "profile"
  ],
  "property": [
    {
      "name": "aa",
      "value": "bb"
    }
  ],
  "exp": 1749957997,
  "iat": 1749957697,
  "jti": "008eed5f-426f-40e9-b0c6-124da1a05e4b"
}