Pular para o conteúdo principal

Configure OpenID Connect - GeCert

GeCert requires a GrantID subscription.

You can either use a SaaS subscription on grantid.com or run your own instance of GrantID.

Configuring GrantID​

Log into the GrantID Console portal and follow the instructions below.

Create an API Connection​

On the Scopes tab, click on New API Connection to create an API connection for the application, providing:

  • Name: gecert
  • Display name: GeCert
  • User Informations (claims): check all

Frontend Application​

On the Applications tab, click on New Application and provide:

  • Name: GeCert
  • App-id: gecert
  • Type: select Implicit flow.

Click on the Settings tab and set:

  • Check the Allow Access tokens via browser? checkbox (if not already checked)
  • Uncheck the following checkboxes (if checked): Require consent?, Front-channel logout session required? and Back-channel logout session required?
  • Application URL: your application's URL. Example: https://gecert.yourcompany.com
  • Allowed URLs:
    • Redirect: add 4 redirect URLs based on your application's URL:
      • <applicationURL> without a trailing slash.
      • <applicationURL>/silent-refresh.html
      • <applicationURL>/private/profile/refresh
      • <applicationURL>/private
    • CORS origins: <applicationURL> without a trailing slash.
    • Post Logout: <applicationURL> without a trailing slash.
  • Allowed Identification Scopes: check all
  • Allowed API scopes: check the GeCert API scope checkbox
warning

Don't forget to save your changes by clicking on the button at the end of the page.

Backend Application​

On the Applications tab, click again on New Application and provide:

  • Name: GeCert Backend
  • App-id: gecert-backend
  • Type: select Client credentials.

Click on the Settings tab and set:

  • Allowed API scopes: check the Manage subscription's users checkbox.
warning

Don't forget to save your changes by clicking on the button at the end of the page.

After saving, go back to the Basic Details tab and, on the App Secret section, click on Generate and then on Generate Secret. This is the value of the AppSecret setting (copy it and keep it for later use).

Gecert Connect application​

Create one more application for Gecert Connect, with an App-id such as gecert-connect, using the authorization code flow with PKCE, with offline access allowed, the GeCert API scope and a redirect URI. Its values go in the server's GecertConnect section: see Configure Gecert Connect on the server.

Configuring GeCert to use GrantID​

Once you have followed the steps above to configure GrantID, fill the section Oidc of the configuration file:

Example (.ini or .conf configuration file):

[Oidc]
Authority=https://login.id.patorum.com
ApiEndpoint=https://api.id.patorum.com
ApiName=gecert
ClientAppId=gecert
AppId=gecert-backend
AppSecret=YOUR_BACKEND_APP_SECRET

Example (environment variables):

Oidc__Authority=https://login.id.patorum.com
Oidc__ApiEndpoint=https://api.id.patorum.com
Oidc__ApiName=gecert
Oidc__ClientAppId=gecert
Oidc__AppId=gecert-backend
Oidc__AppSecret=YOUR_BACKEND_APP_SECRET

First user​

Full Sys Admin privileges are given to the first user that signs in to the application. If another user needs those privileges and nobody can grant them through the application, grant them through the database. Start by finding the user's Id:

SELECT "Id", "Name", "EmailAddress"
FROM "Agents"
WHERE "Subject" IS NOT NULL

Then grant the Owner Sys Admin role (copy the user's Id into the query below). In GeCert, the RootRoleFlags value for the Owner role is 2: 

UPDATE "Agents"
SET "RootRoleFlags" = 2
WHERE "Id" = 'YOUR-USER-ID'

See also​

View as Markdown