Skip to content

IDP

Component Available in version
Organization v1.0

An Organization can let users sign in via an external identity provider instead of, or alongside, native Synkzone accounts. Two kinds of identity provider are supported: a Generic OIDC provider (any corporate IdP speaking OpenID Connect), and Swedish BankID (via GrandID). This is an optional plugin.

Info

Most Organizations using an external IDP for sign-in also use SCIM to provision the underlying user accounts from the same directory. The two are configured independently, but are commonly set up together.

Generic OIDC

Prerequisites

  • An OIDC client registered at the identity provider.
  • The client ID and client secret for that registration.
  • The following redirect URLs registered at the identity provider:
    • <Organization's Synkzone Web URL>/auth
    • https://synkzone.com/auth

Configuration

  1. Point the Organization Server at the identity provider. In main/config/server.config, set IDPType=GenericOIDC and IDPIssuerURL to the provider's issuer URL. This value must exactly match the one specified by the identity provider. See server.config for the full property list.
  2. Set the client ID. Set IDPClientId to the registered client ID.
  3. Add the client secret. Add the client secret to a file and point OAuthClientSecret.path at it.
  4. (Optional) Override the defaults. Set IDPName (defaults to the hostname from IDPIssuerURL) and IDPUserIdClaim (defaults to sub) if the defaults do not fit.
  5. (Optional) Enable auto-provisioning. Set AutoCreateIDPUsers=true to automatically create Synkzone accounts for users signing in via the IDP for the first time.
  6. Restart the main component for the configuration to take effect.

Note

If the identity provider exposes a .well-known/openid-configuration endpoint at IDPIssuerURL, most of the remaining OIDC configuration is discovered automatically. Without it, the IDP may still work using standard defaults.

Example configuration

IDPType=GenericOIDC
IDPIssuerURL=https://login.example.com
IDPClientId=ex4mpl3-client-id
IDPName=My IDP
IDPUserIdClaim=sub
OAuthClientSecret.path=/config/oauth-client-secret
AutoCreateIDPUsers=true

ExAmPlEcLiEnTsEcReT1234567890abcdefgh

Swedish BankID

Prerequisites

  • A GrandID account and API key.
  • A BankID key from GrandID.

Configuration

  1. Configure the GrandID connection. In main/config/server.config, set GrandIdAPI to the GrandID API endpoint, and PersonalIdentificationTypes (for example SWEDISH_MOBILE_BANK_ID). See server.config for the full property list.
  2. Add the GrandID API key. Add the key to a file and point GrandIdAPIKey.path at it.
  3. Add the BankID key. Add the key to a file and point GrandIdBankIdKey.path at it.
  4. Restart the main component for the configuration to take effect.

Example configuration

GrandIdAPI=https://client.grandid.com/json1.1
GrandIdAPIKey.path=/config/grandid-api-key
GrandIdBankIdKey.path=/config/grandid-bankid-key
PersonalIdentificationTypes=SWEDISH_MOBILE_BANK_ID

ExAmPlEgRaNdIdApIkEy1234567890

ExAmPlEgRaNdIdBaNkIdKeY1234567890