OpenID Connect Protocol

OpenID Connect (OIDC) is an authentication protocol based on OAuth 2.0. The protocol allows applications to verify user identity and obtain user information from an Identity Provider.

Axidian Privilege supports the following OIDC authentication modes:

• Compatibility mode — sign-in by email address and identifier

  If a user has no identifier (sub) set, authentication compares the PAM user's email address with the email in the Identity Provider. If the addresses match, the user signs in to the console, and the received identifier is saved and used for subsequent authentication.

• Strict mode — sign-in by identifier only

  Only users with a defined identifier (sub) can sign in to the Axidian Privilege console; matching by email address is disabled. The identifier is not saved automatically and is set by the administrator in the PAM console. Use strict mode to reduce the risk of unwanted linking of privileged accounts.

info

Proxy components do not support OpenID Connect authentication.
To access resources, enable the Session opening without re-authentication and/or SSH Key Authentication options.

Set up authentication

To set up authentication via an external Identity Provider:

1. In the administrator console, go to the Configuration → User Authentication → Authentication via OIDC Identity Provider section.

2. Fill in the required parameters.

   Parameters

   Option	Description
   Enable authentication via OIDC Identity Provider	The option enables authentication using the OpenID Connect protocol via an external Identity Provider. Login using a username and password remains available.
   Login button name	The name of the authentication button for the Identity Provider. The button is displayed on the sign-in page of the Axidian Privilege console.
   Match users by email on first login	Compatibility mode Enable the option to match users by email address if the identifier (sub) is not set in PAM. After sign-in, the identifier is saved and used for subsequent authentication. Strict mode Disable the option so that only users with a predefined identifier (sub) can sign in to PAM via OIDC.
   Redirect URI	The address to which the Identity Provider redirects the user after authentication. Copy this value and specify it when registering PAM in the Identity Provider settings.
   OIDC Provider URL	The OIDC server address from the Identity Provider settings. Example: https://idp.company.ru.
   Authentication flow	Available OIDC authentication flows Authorization Code Flow — the user is redirected to the authorization server and receives a code that is exchanged for an access token. Authorization Code Flow + PKCE (default) — the recommended flow that uses the Proof Key for Code Exchange (PKCE) extension. An additional secret is generated for each authorization request and is verified when exchanging the code for an access token. Implicit Flow — the authorization server returns the access token in the URL after user authentication. This flow is not recommended due to the risk of token interception.
   Client ID	The client identifier created when registering PAM in the Identity Provider.
   Client Secret	The client secret issued when registering PAM in the Identity Provider.
   Claim	OIDC attribute that PAM uses to retrieve the user’s email to match the user account. The default value is email.
   Scope	The name of the OIDC scope used in the request to the OIDC provider to retrieve the claim containing the user's email. The default value is email.

3. Click Save.

After the setup, authentication via an external Identity Provider is available on the sign-in page of the Axidian Privilege console.

Manage authentication

After setting up authentication, make sure that for users who need access to PAM:

• OIDC authentication is allowed
• an email address (email) or identifier (sub) is set

OIDC authentication

To allow or deny a user to sign in via OIDC:

1. In the administrator console, go to the Users section and open the user profile.
2. Go to the Authenticators tab and, next to the OIDC authentication field, click .
3. In the dialog that opens, select an option:
   • Allow — the user can sign in via an external Identity Provider (default).
   • Deny — the user cannot sign in via OIDC regardless of the configuration, the defined identifier (sub), and the email address (email).
4. Click Save.

Subject Identifier (sub)

caution

In strict mode, the identifier (sub) in Axidian Privilege must match the sub value in the Identity Provider. If the identifier (sub) is not set or is outdated in PAM, sign-in via OIDC is unavailable.

To set the identifier (sub):

1. In the administrator console, go to the Users section and open the user profile.
2. Go to the Authenticators tab and, next to the Subject Identifier (sub) field, click .
3. In the dialog that opens, specify the identifier and click Save.

To delete the identifier (sub), next to the Subject Identifier (sub) field, click . If matching by email address is enabled in the configuration, a new identifier (sub) value is saved after the user signs in to the PAM console.

Email address (email)

To add or update the email address (email):

1. In the administrator console, go to the Users section and open the user profile.

2. Next to the Email field, click and specify the email address.

   info

   If the user is from a directory service, change the email address in the directory — the data in Axidian Privilege is updated automatically.

3. Click Save.

Sign in to PAM via OIDC

info

Authentication via an external Identity Provider is an additional sign-in method.
Sign-in with login and password remains available.

1. Open the user console or the administrator console.
2. Proceed to authentication via the external Identity Provider.
   If the sign-in attempt fails, contact the PAM administrator.