Configure Perceptive Content Server to use an OpenID Connect Login Profile - Configure Perceptive Content Server to use an OpenID Connect Login Profile - To configure Perceptive Content Server to support OpenID Connect through login profiles, complete the following steps. - Perceptive Content - Perceptive Integration Server on Tomcat Installation and Setup Guide - Perceptive-Content/Perceptive-Integration-Server-on-Tomcat-Installation-and-Setup-Guide/Foundation-24.1/Perceptive-Integration-Server-on-Tomcat-Installation-and-Setup-Guide/Configure-Integration-Server/Configure-Integration-Server-for-OpenID-Connect-authentication/Configure-Perceptive-Content-Server-to-use-an-OpenID-Connect-Login-Profile - Foundation 24.1 - Foundation 24.1

To configure Perceptive Content Server to support OpenID Connect through login profiles, complete the following steps.

1. In the etc folder of your Perceptive Content Server deployment, open the inserver.ini file in a text editor.
2. Create the [OpenID Connect Login Profiles] section and set sso.openid.profiles to the same as the corresponding value in the integrationserver.ini file.
   Note: Profile names must only contain alphanumeric characters.
3. Enter the OpenID client id for each profile into the sso.openid.profile.[profileName].client.id setting.
4. Enter the OpenID client secret associated with the client id of each profile into the sso.openid.profile.[profileName].client.secret setting.
   Note: OpenID client secrets in inserver.ini can be encrypted by running the inserver -encrypt-config command. We recommend you run this command each time you update a client secret. Do not manually update the encrypted client secret settings.
5. The sso.openid.profile.[profileName].user.claim setting maps OpenID authenticated end-users to Perceptive Content users. The user claim values should map one-to-one to Perceptive Content usernames. The user claim must be specified as a JSON attribute path. This path must identify a claim in the JSON object returned from the UserInfo endpoint of the OpenID Provider. For more information about the syntax of JSON attribute paths, see the JSON attribute paths topic in the Online Help.
6. If the OpenID Provider supports discovery, enter the discovery endpoint into the sso.openid.profile.[profileName].discovery.endpoint setting.
   Note: When using OpenID Connect Discovery, OpenID configuration is cached in Perceptive Content. Perceptive Content refreshes OpenID configuration based on the discovery refresh interval setting on login profiles. To force Perceptive Content to invalidate cached OpenID configuration you can run the following command.

   intool --cmd openidconnect-invalidate-discovery-configuration

7. If the OpenID Provider doesn't support discovery, configure the following settings.
   1. Set sso.openid.profile[profileName].auto.discovery to FALSE.
   2. Enter the OpenID Provider's issuer URI into the sso.openid.profile.[profileName].issuer.uri setting.
   3. Enter the URL of the OpenID Provider's token endpoint into the sso.openid.profile.[profileName].token.endpoint setting.
   4. Enter the URL of the OpenID Provider's userinfo endpoint into the sso.openid.profile.[profileName].userinfo.endpoint setting.
   5. Prior to using OpenID Connect authentication, you must establish trust with OpenID Provider by importing one or more token signing keys. Use the following command with the OpenID Provider's signing certificate.

      intool --cmd import-cert --file <certificate file name> --type openid-connect -
      -login-profile <profile name> --key-id <key ID value>

      Note: You will need to determine what values the OpenID Provider uses for key IDs. Refer to documentation for the OpenID Provider to determine how they identify signing keys. Signing keys and key IDs are automatically imported when using OpenID Connect Discovery.
8. Ensure that the SSL/TLS root CA for the OpenID Provider is imported into the SSL trust store on the system where Perceptive Content Server is running. Refer to the Perceptive Content Installation Guide for more information on configuring trust for SSL/TLS.
9. OpenID client secrets in inserver.ini can be encrypted by running the inserver -encrypt-config command. This command should be ran each time a client secret is updated. Do not manually update the encrypted client secret settings.
10. Configure any optional login profile settings. A detailed explanation of each login profile setting is provided in the inserver.ini OpenID Connect Login Profiles settings topic in the Content System Online Help (optional).

    [OpenID Connect Login Profiles]
    sso.openid.profiles=hylandexperience, defaultwithoutdiscovery
    
    sso.openid.profile.hylandexperience.client.id=d48d37b4-c6ac-43a3-9864-60b9bad5c683
    sso.openid.profile.hylandexperience.client.secret=ZJYCqe3GGRvdrudKyZS0XhGv_Z45DuKhCUk0gBR1vZk
    sso.openid.profile.hylandexperience.user.claim=username
    sso.openid.profile.hylandexperience.discovery.endpoint=https://sample.onbase.com/IdentityProvider/.well-known/openid-configuration
    
    sso.openid.profile.defaultwithoutdiscovery.client.id=f282592c-e5e4-4b9f-a3fb-022b6c149f04
    sso.openid.profile.defaultwithoutdiscovery.client.secret=HJmUFH3GGRvdrudKyZS0XhGv_Z45DuKhCUk0gJkdnU2
    sso.openid.profile.defaultwithoutdiscovery.user.claim=username
    sso.openid.profile.defaultwithoutdiscovery.issuer.uri=https://sample.onbase.com/IdentityProvider
    sso.openid.profile.defaultwithoutdiscovery.token.endpoint=https://sample.onbase.com/IdentityProvider/connect/token
    sso.openid.profile.defaultwithoutdiscovery.userinfo.endpoint=https://sample.onbase.com/IdentityProvider/connect/userinfo