Zum Inhalt

Single Sign-On (SSO)

The Rulemapping Automation Platform (RAP) is a web-based multi-user-system where users access the central server through a standardized web browser. Single Sign On (SSO) technology based on OpenID Connect (OIDC) can be used as an alternative to the usual login form.

Note that because of the complex and fine granular user access rights, the management of user details, roles and rights happens within the RAP system. The OIDC SSO is used to replace the username/password login process. Each user needs to be setup individually with the required access rights in RAP user management matching the email address which will be provided via the OIDC setup.

Four OIDC providers are supported:

  • Microsoft Active Directory Federation Services (ADFS)
  • Microsoft Azure Entra ID (formerly Azure Active Directory)
  • Okta
  • Keycloak (note to switch off token introspection)

Configuration

In order to use SSO with the RAP, a few configuration options need to be agreed on upfront by the customer and Rulemapping. Apart from the OIDC configuration options listed below, RAP has no further SSO specific requirements.

Options provided by the customer

client-id

The client ID is the identifier for the customer OIDC application obtained when registering the application with the OIDC service.

client-secret (optional)

The client secret is the password for the customer OIDC application configured when registering the application with the OIDC service.

openid-configuration-url

Configuration endpoint URL to interact with the resource owner.

scope (optional, default "openid email")

The OAuth 2.0 scope for the user authentication process.

Setup / SaaS hosting

After providing the needed information, the Rulemapping team will configure the hosted instance accordingly and provided the following URLs when <prefix> is not known.

The URL of the RAP web application has usually the following form when hosted by Rulemapping:

https://<prefix>.rulemapping.app/<prefix>/

where <prefix> is the name of the customer specific project.

The URL of the RAP SSO login has then the following form:

https://<prefix>.rulemapping.app/<prefix>/oauth2/

Setup / On-Premis

In case you are running the RAP system on your side, you need to configure the collected OICD information into the ktbs.cl file as following:

...
:oauth2-client-id "..."
:oauth2-client-secret "..."
:oauth2-openid-configuration-url "https://.../.well-known/openid-configuration“
...

Keycloak

Note that keycload does not offer server side introspection of the ID token. Switch off this additional check by setting

...
:oauth2-introspect-token-p nil
...

Usage

Customers can directly link the above oauth2 URL in their company portal or they can rely on the SSO link displayed on the standard login form.