Configure the OpenID Connect provider

Key

Value

Client ID

The client ID configured in the external STS.

Client Secret

Client secret as defined by OAuth 2.0 specs. It is not needed for implicit flow (response type is set to id_token).

Response type

Determines the authorization flow as defined by OAuth 2.0 specs. Default is code for authorization code flow. Use id_token for implicit flow. It is recommended to use authorization code flow with PKCE when possible.

Authority

The absolute path to the external STS.

Allowed scopes

Enter the scopes, required by your scenario. The minimum required scopes for Sitefinity CMS to work with the OpenID Connect provider are openid email.

Metadata address

Enter the absolute URL from where to retrieves the OpenID metadata.

If you leave it empty, the default URL is used: {Authority}/.well-known/openid-configuration

Redirect URI

Your Sitefinity Redirect URI: e.g https://yoursitefinitysite/. When no Callback path is provided it can also be followed by any random path as long as it is free. Example:https://yoursitefinitysite/any_free_random_path.

If callback path is provided it must match the callback path.

Callback path

An optional constrained path, on which to process the authentication callback. If you do not provide a value, the value is generated from the Redirect URI parameter, for example: /Sitefinity/Authenticate/OpenID/signin-custom.

NOTE: Each external provider has a unique endpoint.

Post logout redirect URI

You configure this parameter in the settings of the Identity server client of the external STS as a redirect URI. Enter the desired post logout URI from your site, for example, http://mysitefinitysite

NOTE: This must be a URL from your site. 

Validate OpenIdConnect.nonce cookiе

Specify whether requests must require OpenIdConnect.nonce cookie for authentication. This option allows local development when browsers require secure transport of cookies with SameSite attribute set to None. For more information, see OpenIDConnect.nonce cookie and SameSite cookie attribute.

• Enabled
  If you want all requests to require OpenIdConnect.nonce cookie for authentication, select Enabled. This option must be enabled in secure, encrypted context.
  

  IMPORTANT: To avoid security risks, set Enabled before deploying your project to a live environment.

• Disabled
  If you do not want any requests to require OpenIdConnect.nonce cookie for authentication, select Disabled.

  IMPORTANT: Use this option only for local development under HTTP.

• RemoteOnly
  This is the default option. If you want remote requests to require the OpenIdConnect.nonce cookie for authentication over HTTPS, but do not want it required for requests to localhost, select RemoteOnly.

  NOTE: The cookie is not required only for requests to localhost, other local domains still require the cookie.

Use PKCE

Enables or disables the use of the Proof Key for Code Exchange (PKCE) standard. This only applies when the response type is set to code.

Data provider

Enter the name of the local membership provider where users are created.

Title

The text that is displayed on the login button, for example, OpenID.

Auto assigned roles

Optionally, enter the roles that are automatically assigned to users registered with the OpenID Connect provider (separated with a comma). For more information about using auto-assigned roles together with user groups, see Use external authentication providers with user groups.

Link CSSclass

Enter the CSS to be applied to the login button.

Require email claim from this provider

This option, specifies whether you want to use the email address, provided by the external provider to map external users to Sitefinity CMS users.

Select this checkbox, if you want users to be able to login, only if their valid email is included in the provided claim.

This checkbox sets to true or false MapUsersViaEmail property. By default, it is selected.