A realm and client need to be configured in the Identity Service for the Alfresco products to sit under. A single realm is required, however multiple clients may be used instead of the single one used in this example.
A separate client always needs to be created and configured for Desktop Sync if it is used. The configuration steps for this additional client can be ignored if Desktop Sync is not used.
- Sign in to the administrator console of the Identity Service as an administrator. The URL of the Identity Service administrator console is
https://ids.example.com/auth/admin. - Select the default realm,
Alfrescoor create a new realm to use that the Alfresco products will be accessed through. Note down the Name for later use. The realmAlfrescowill be used in this example. - Select Tokens and set a timeout period in the Realm Settings for the realm
Alfresco. -
Use the default client under the
Alfrescorealm or create a new client and configure it. Make sure that at least the following are set:- The client is Enabled.
- A Client ID is set.
- Implicit Flow Enabled is switched on.
- A wildcard
*is entered for Valid Redirect URIs. - To configure single logout for Process Services add the following URL into the Admin URL:
aps.example.com/activiti-app.
-
Create a new client for Alfresco Share under the
Alfrescorealm or the realm you created, setting at least the following:In the Settings tab:
- Client ID is set to a valid value, for example
share. - Enabled must be set to true.
- Client Protocol is set to
openid-connect. - Access Type is set to public.
- Standard Flow is enabled.
- Valid Redirect URIs is set to
*.
- Client ID is set to a valid value, for example
-
Create a new client for Desktop Sync under the
Alfrescorealm or the realm you created setting at least the following :In the Settings tab:
- A unique and identifiable Client ID .
- The Valid Redirect URI must be set to
http://127.0.0.1*, http://localhost*. - Implicit Flow Enabled is switched off.