FintechOS Identity Provider

IMPORTANT!
Starting with release 22.1, the FintechOS Platform uses the FintechOS Identity Provider as the default authentication layer for the FintechOS applications and services. Alternate authentication methods are provided only for backward compatibility.
For more information, see Deprecated Identity Providers.

The FintechOS Identity Provider is an OpenID compliant identity and access management solution based on the Keycloak authentication server. All FintechOS Platform components, such as Innovation Studio, FintechOS Portal, or FintechOS API, are represented in the FintechOS Identity Provider as different clients of the same FintechOS realm.

NOTE
User credentials and roles set up in Innovation Studio are stored by the FintechOS Identity Provider. When creating, updating, or deleting a user account in Innovation Studio, the changes are automatically propagated in the FintechOS Identity Provider.

Identity Brokering

The FintechOS Identity Provider supports identity brokering, allowing users to log in to FintechOS applications and services using any external identity provider that supports the OpenID Connect standard. You can find examples for common external identity providers configurations below:

FintechOS Identity Provider Settings

In the FintechOS Cloud Configuration Manager, set up the following secrets:

Key Path	Key Name
kv/<environment>/<application>/app-settings	EBSDefaultAuthentication
kv/<environment>/<application>/app-settings	core-setting-external-auth-provider-key-url
kv/<environment>/<application>/app-settings	core-setting-external-auth-provider-issuer
kv/<environment>/<application>/app-settings	openid-client-id
kv/<environment>/<application>/app-settings	openid-client-secret
kv/<environment>/<application>/app-settings	openid-discovery-endpoint
kv/<environment>/<application>/app-settings	openid-callback-url

Key Name	Key Description
EBSDefaultAuthentication	Specifies the identity provider: FTOSOIDC - FintechOS Identity Provider EBS - Legacy FintechOS Platform authentication (deprecated) IMPORTANT! In a non-standard scenario where a regular portal using FintechOS Identity Provider is linked to a B2C portal using legacy authentication, it is recommended to have each portal reside on a separate domain. The requests will pass successfully only if coming from FTOS IDP towards B2C (the other way around, errors may occur). AD - Microsoft Active Directory Authentication (deprecated). AzureAD - Azure Active Directory Authentication (deprecated). Okta - Authentication with Okta (deprecated) ADFS - Authentication with Active Directory Federation Services (deprecated). AWSCognito - Authentication with AWS Cognito (deprecated)
core-setting-external-auth-provider-key-url	Link to the FintechOS Identity Provider public keys used to validate the digital signatures of the access tokens. E.g.: https://myHPFI.myDomain.com/auth/realms/fintechOSRealm/protocol/openid-connect/certs
core-setting-external-auth-provider-issuer	FintechOS Identity Provider instance identifier as provided in the issue field of the authentication token. This value is case sensitive. E.g.: https://myHPFI.myDomain.com/auth/realms/fintechOSRealm
openid-client-id	Your FintechOS Platform component's corresponding Client ID as defined in the FintechOS Identity Provider. E.g.: admin-portal, myInnovationStudio. In the FintechOS Identity Provider admin console, you can find the list of Client IDs in the Clients section of your FintechOS realm.
openid-client-secret	Your FintechOS Platform component's corresponding client secret generated by the FintechOS Identity Provider. In the FintechOS Identity Provider admin console, you can find the client secret in the Credentials tab of your client's page.
openid-discovery-endpoint	FintechOS Identity Provider endpoint. E.g.: https://myHPFI.myDomain.com/auth/realms/fintechOSRealm/.well-known/openid-configuration In the FintechOS Identity Provider admin console, you can find the discovery endpoint address in the Realm Settings section.
openid-callback-url	URL where the user agent is redirected after a successful login. The default value is `{<Studio/Portal base URL>/Account/LogonCallback`. A matching entry must be configured in the FintechOS Identity Provider as a valid redirect URI for the client.

(Deprecated) Configuration using web.config keys:

Copy

<app-settings>
    ...
    <!-- Set FintechOS Identity Provider authentication-->
    <add key="EBSDefaultAuthentication" value="FTOSOIDC" />
    
    <!-- External authentication provider settings-->
    <add key="core-setting-external-auth-provider-key-url" value="{AccessTokenPublicKey}" />
    <add key="core-setting-external-auth-provider-issuer" value="{AccessTokenIssuer}" />
     
    <!-- Replace these values with your FintechOS Identity Provider configuration: -->
    <add key="openid-client-id" value="{ClientId}" />
    <add key="openid-client-secret" value="{ClientSecret}" />
    <add key="openid-discovery-endpoint" value="{DiscoveryEndpointUrl}" />
    <add key="openid-callback-url" value="{CallbackUrl}" />
    ...
</app-settings>

Set up Service Account Roles for the Innovation Studio Client

Innovation Studio clients require full privileges for membership management (CRUD operations with users, password change/reset, etc.). For this purpose, a realm management service account role must be assigned to Innovation Studio clients:

Log in to the FintechOS Identity Provider admin console.
Select your FintechOS Platform realm.
Select the Clients blade.
Open the Innovation Studio client.
Go to the Service Account Roles tab.
In the Client Roles drop-down, select realm-management and assign all the available roles.

How users log in the FintechOS Platform Portal or Innovation Studio

When accessing the FintechOS Platform Portal or Innovation Studio, users who have an active OpenID session are logged in automatically. Otherwise, they are displayed the FintechOS Identity Provider single sign-on login page and will use the OpenID account credentials to log in to the FintechOS Platform Portal or Innovation Studio.

FintechOS Platform user account automatic synchronization

When a user logs in to FintechOS Platform Portal or Innovation Studiousing the FintechOS Identity Provider single sign-on, the following information stored in the corresponding FintechOS Platform user account is updated automatically based on the FintechOS Identity Provider account settings:

First Name
Last Name
Email
Security roles
External user ID (uniquely identifies the user by an external identity provider)