Configuration of an Arbitrary OpenID Connect Identity Provider

To carry out the necessary configuration steps, please refer to the corresponding third-party documentation.

The following claims must be provided in the ID token:

• email
• given_name
• family_name

The email claim must contain the user’s e-mail address, which is used for the Fabasphere log-in.

The identity provider must publish a wellknown URL (see https://openid.net/specs/openid-connect-discovery-1_0.html: new window) at the following endpoint:

<issuer>/.well-known/openid-configuration

Note: Some identity providers use different names for the issuer URL, for example authority URL.

The redirect URI on the OIDC server must match the following configuration:
https://<server>/idp/profile/Authn/OIDC/RP/callback

Where <server> is the address of the server running the Fabasphere. I.e., the Fabasphere must be reachable via https://<server>/folio.