Users Guide

d. (Optional) Certificate Validation check box - You can select the check box and upload the OIDC provider's certificate by
clicking Browse and locating the certificate or by dragging and dropping the certificate in the 'broken line' box.
e. (Optional) Test connection - Click Test URI and SSL Connection to test the connection with the OpenID Connect
provider.
NOTE: Test connection does not depend on the username and password or the initial access token details, as it only
checks for the validity of the Discovery URI provided.
f. (Optional) Enabled check box - You can select the check box to allow the authorized client access tokens to login to the
appliance.
3. Click Finish.
The newly added OpenID Connect provider is listed on the Application Settings > Users > OpenID Connect providers page and
the Client ID can be located on the right pane.
Next steps:
Configure an OpenID Connect provider policy in PingFederate for role-based access to OpenManage Enterprise on page 153
Configure an OpenID Connect provider policy in Keycloak for role-based access to OpenManage Enterprise on page 154
Configure an OpenID Connect provider policy in PingFederate for
role-based access to OpenManage Enterprise
To enable OpenManage Enterprise OpenID Connect login using PingFederate, you must add and map a scope dxcua (Dell
extended claim for user authentication) to the Client ID and define the user privileges as follows:
WARNING:
User roles and scopes are reset to 'default' on client re-registration with OIDC provider
PingFederate (PingIdentity). This issue might reset the privileges and scope of non-admin roles (DM and
Viewer) to that of the Administrator. Re-registration of the appliance console with OIDC provider is triggered in
the event of an appliance upgrade, change in network configuration, or change in SSL certificate.
To avoid security concerns post any of the above-mentioned re-registration events, the administrator must
reconfigure all the OpenManage Enterprise Client IDs on the PingFederate site. Also, it is highly recommended
that Client IDs are created only for Administrator users with Pingfederate till this issue is resolved.
NOTE:
● The default assigning algorithm should be RS256 (RSA Signature with SHA-256).
1. Add an 'exclusive' or 'default' scope called dxcua under Scope Management in OAuth Settings.
2. Map the scope created in OpenID Connect Policy Managment > Policy using the following steps:
a. Enable Include User info in Token
b. In the Attribute Scope, add the scope and attribute value as dxcua.
c. In Contract fulfillment, add dxcua and select the type as 'Text'. Then, define the user privileges for OpenManage
Enterprise OpenID Connect provider login using one of the following attributes:
i. Administrator: dxcua : [{“Role": "AD"}]
ii. Device Manager: dxcua : [{“Role": "DM"}]
NOTE:
To restrict access of the device manager to select device groups, say G1 and G2, in OpenManage
Enterprise use dxcua : [{“Role": "DM", "Entity":"G1, G2"}]
iii. Viewer: dxcua : [{“Role": "VE"}]
d. If an 'exclusive' scope is configured after the client registration in OpenManage Enterprise, edit the configured client in
PingFederate and enable the created 'dxcua' exclusive scope.
3. Dynamic client registration should be enabled in PingFederate for OpenManage Enterprise client registration. If the
'Require Initial access token' option is unselected in OpenID Connect provider client settings, the registration will work with
Username and password. If the option is enabled, then the registration will work only with the Initial Access token.
Managing OpenManage Enterprise appliance settings
153