I was asked if an application (SimPlan SimController) can authenticate against Advanced Authentication. The application, among other, has these requirements: Roles: “admin” – Admin rights on the SimController Web “user” – Basic user rights on the SimController Web This should be included in the “roles” Claim in the access token, e.g.: roles: [“user”] Scopes: “simcontroller_access” Scope which will be requested by the frontend and must then be included in the scopes (“scp”) claim of the access token. I'm at a loss; is this something you can do with Advanced Authentication? I haven't found anything about claims and scopes in the documentation. Does anyone have any tips or ideas? Thanks

Hello Mirko, Sorry, I had to check internally. I think this is not possible as of today. OpenID uses a single “openid” scope and I do not see other way to set up roles. You can always create a new enhancement request in the Ideas Portal for Product Management to consider it. Thanks. Regards, Luciano Testa

Hello Mirko, There isn't much information except the Web Authentication Method: https://www.netiq.com/documentation/advanced-authentication-64/server-administrator-guide/data/web_auth_method.html Plus the OpenID Connect page: https://www.netiq.com/documentation/advanced-authentication-64/server-administrator-guide/data/openid_connect_for_aa.html And the examples in the following chapters. Hope that helps. If you test it, does this work at all? Thanks. Regards, Luciano Testa

Advanced Authentication Discussions

Using OpenID Connect scopes

mguldner 3 months ago

I was asked if an application (SimPlan SimController) can authenticate against Advanced Authentication. The application, among other, has these requirements:

Roles:
- “admin” – Admin rights on the SimController Web
- “user” – Basic user rights on the SimController Web
- This should be included in the “roles” Claim in the access token, e.g.: roles: [“user”]
Scopes:
- “simcontroller_access” Scope which will be requested by the frontend and must then be included in the scopes (“scp”) claim of the access token.

I'm at a loss; is this something you can do with Advanced Authentication? I haven't found anything about claims and scopes in the documentation.

Does anyone have any tips or ideas?

Thanks

Tags:

OpenID Connect

scopes

claims

Top Replies

Suggested Answer

0 Luciano Testa 3 months ago

Hello Mirko,

There isn't much information except the Web Authentication Method:

https://www.netiq.com/documentation/advanced-authentication-64/server-administrator-guide/data/web_auth_method.html

Plus the OpenID Connect page:

https://www.netiq.com/documentation/advanced-authentication-64/server-administrator-guide/data/openid_connect_for_aa.html

And the examples in the following chapters.

Hope that helps. If you test it, does this work at all?

Thanks.

Regards,

Luciano Testa
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 mguldner 3 months ago in reply to Luciano Testa

Hello Luciano,

correct me if I am wrong, but as I understand it the Web Authentication Method is a way to integrate external Identity Providers. To be honest, I don't understand the use case. But I think, it's not what we want to do.

I think what we need is an OpenID Connect Event that can be configured to provide role (=user or admin) and scope (=simcontroller_access) in the authentication response.

I don't know if Advanced Authentication can do it. Even if the answer is no that would be valuable information for me - I then can provide feedback to the requestor, and we can start looking for another solution for this application.

Thanks,

Mirko
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
Verified Answer

+1 Luciano Testa 3 months ago in reply to mguldner

Hello Mirko,

Sorry, I had to check internally. I think this is not possible as of today. OpenID uses a single “openid” scope and I do not see other way to set up roles.

You can always create a new enhancement request in the Ideas Portal for Product Management to consider it.

Thanks.

Regards,

Luciano Testa
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel
0 mguldner 3 months ago in reply to Luciano Testa

Hello Luciano,

thanks for checking this. I'll create an idea.

Best regards,

Mirko Guldner
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel

Menu

Advanced Authentication Discussions

Using OpenID Connect scopes

Tags:

Top Replies

Suggested Answer

Verified Answer

Resources