Previous Topic: Add Self-Registration Rule and Response to the PolicyNext Topic: Create the OTK/OIDC Database (Oracle)

Single Sign-On Service › SSO Getting Started Guide › SSO Using CloudMinder as an OAuth Authorization Server

SSO Using CloudMinder as an OAuth Authorization Server

As a CSP administrator, you can configure single sign-on so that CA CloudMinder acts as an OAuth authorization server for an OAuth client.

You perform configuration steps for each tenant where SSO for an OAuth client is required. You perform these steps only once per tenant.

You also perform configuration steps for each individual OAuth client that will use CA CloudMinder as an OAuth authorization server. You perform these steps for each OAuth client that is associated with the tenant.

For example, the tenant Forward, Inc. wants to use CA CloudMinder as an OAuth authorization server for to two web application and a mobile application. Each of these applications use OAuth for authentication communication; they are called OAuth clients. As a CSP administrator, you configure CloudMinder as an OAuth authorization server for the Forward, Inc. tenant environment. Then you configure single sign-on using OAuth for the two web applications and the mobile application. Because each application has specific callback and authentication URLs, you configure each one separately.

The following figure illustrates the required configuration tasks.

This figure illustrates how to configure the system as an OAuth authorization server.

The following procedures describe each task in detail.

Do the following for each tenant where SSO for an OAuth client is required. Perform these steps only once per tenant. Begin here if you have not configured the OAuth authorization server for this tenant yet.

  1. Create the OTK/OIDC Database (Oracle) or Create the OTK/OIDC Database (PostgreSQL)
  2. Create an Identity Provider for CA Directory
    3. Create a JDBC Connection to the OTK/OIDC Database (Oracle) or Create a JDBC Connection to the OTK/OIDC Database (PostGres)
  3. Install OpenID Connect
  4. Update the Authorize Endpoint
  5. Update the UserInfo Endpoint
  6. Restart Gateways

Do the following for each OAuth client you want to use the OAuth authorization server. Perform these steps for every OAuth client. Begin here if you have already configured the OAuth authorization server for this tenant, and you want to configure individual OAuth clients to use it.

  1. Create the Authentication Method
  2. Create an Application
  3. Set Callback and Authentication URLs