Users Guide

b. Discovery URI - Uniform Resource Identifier of the OIDC provider
c. Authentication type - Choose from one of the following methods the access token must use to access the appliance:
i. Initial Access Token - Provide the Initial access token
ii. Username and Password - Provide the username and password
d. (Optional) Certificate Validation check box - You can select the check box and upload the OIDC provider's certificate by
clicking Browse and locating the certificate or by dragging and dropping the certificate in the 'broken line' box.
e. (Optional) Test connection - Click Test URI and SSL Connection to test the connection with the OpenID Connect
provider.
NOTE: Test connection does not depend on the username and password or the initial access token details, as it only
checks for the validity of the Discovery URI provided.
f. (Optional) Enabled check box - You can select the check box to allow the authorized client access tokens to login to the
appliance.
3. Click Finish.
The newly added OpenID Connect provider is listed on the Application Settings > Users > OpenID Connect providers page and
the Client ID can be located on the right pane.
Next steps:
Configure an OpenID Connect provider policy in PingFederate for role-based access to OpenManage Enterprise on page 140
Configure an OpenID Connect provider policy in Keycloak for role-based access to OpenManage Enterprise on page 140
Configure an OpenID Connect provider policy in PingFederate for
role-based access to OpenManage Enterprise
To enable OpenManage Enterprise OpenID Connect login using PingFederate, you must add and map a scope dxcua (Dell
extended claim for user authentication) to the Client ID and define the user privileges as follows:
NOTE: The default assigning algorithm should be RS256 (RSA Signature with SHA-256).
1. Add an 'exclusive' or 'default' scope called dxcua under Scope Management in OAuth Settings.
2. Map the scope created in OpenID Connect Policy Managment > Policy using the following steps:
a. Enable Include User info in Token
b. In the Attribute Scope, add the scope and attribute value as dxcua.
c. In Contract fulfillment, add dxcua and select the type as 'Text'. Then, define the user privileges for OpenManage
Enterprise OpenID Connect provider login using one of the following attributes:
i. Administrator: dxcua : [{“Role": "AD"}]
ii. Device Manager: dxcua : [{“Role": "DM"}]
iii. Viewer: dxcua : [{“Role": "VE"}]
d. If an 'exclusive' scope is configured after the client registration in OpenManage Enterprise, edit the configured client in
PingFederate and enable the created 'dxcua' exclusive scope.
3. Dynamic client registration should be enabled in PingFederate for OpenManage Enterprise client registration. If the
'Require Initial access token' option is unselected in OpenID Connect provider client settings, the registration will work with
Username and password. If the option is enabled, then the registration will work only with the Initial Access token.
Configure an OpenID Connect provider policy in Keycloak for role-
based access to OpenManage Enterprise
To enable OpenManage Enterprise OpenID Connect login using Keycloak, you must first add and map a scope dxcua to the
Client ID and define the user privileges as follows:
NOTE:
The Discovery URI specified in the OpenID Connect provider configuration wizard should have a valid endpoint of
the provider listed.
1. In the Attributes section of Keycloak Users, define the 'Key and Value' for OpenManage Enterprise login roles using one of
the following attributes:
● Administrator : dxcua : [{"Role": "AD"}]
● Device Manager: dxcua : [{"Role": "DM"}]
140
Managing OpenManage Enterprise appliance settings