Configuring OpenID Connect

1. Configure OpenID Connect

OpenID Connect is an extension that adds identity to OAuth2.

To configure OpenID Connect you need 3 things

Client ID
Client Secret (Sometimes empty/not required)
Issuer (99% of the time this is just the domain of the provider) Ex: http://login.example.com.

1.1. FusionAuth Example

In the following example we will setup a FusionAuth OpenID Connect configuration. We need to give it a name and a tenant (if there is a tenant other than the default). Then click save.

1.1.1. First we need to create a FusionAuth application.

1.1.2. You will need to immediately edit the application

Set the redirect URL to your CleanSpeak URL with a path of /oauth for example: https://example-cleanspeak.inversoft.io/oauth.
Copy your client id and client secret for later
(Optional) Set the logout URL to your CleanSpeak URL so that after a logout the users will be redirected back to the login page.
(Optional) Remove the refresh token grant to lock down the security.

1.1.3. Now we need to copy the values from the last step into the CleanSpeak configuration.

Copy client id and client secret
Set the issuer to the domain of your fusionauth domain. Ex: https://local.fusionauth.io
Set the button text. Ex: Login with FusionAuth
(Optional) Set the button image. Ex: https://local.fusionauth.io/images/icon.png (Hint: there is a fusionauth icon available at /images/icon.png on every instance of FusionAuth)
(Optional) Set the logout url so that a user is logged out of FusionAuth globally. Ex: https://local.fusionauth.io/oauth2/logout
Save

1.2. Azure Example

Azure OpenID has a slightly different workflow because it uses a slightly different path for the issuer. This is because Azure uses tenant specific OpenID URLs.

1.2.1. First we again need to create an application.

First navigate to your portal
Open Azure Active Directory
Open App registrations on the new inner left menu. (The screen should look like the image below)
Click New registration
Choose a name and set the redirect URI
Click register

1.2.2. You should now see a screen like the following.

1.2.3. Now open CleanSpeak System Settings

Paste https://login.microsoftonline.com/{tenantId} into the issuer field of your. (With {tenantId} replaced with your own)
Copy the Client ID from your azure application and paste that in the Client ID field of CleanSpeak

1.2.4. Now we need a client secret (which is required for all web based applications on Azure)

Go to your Azure app
Open certificates and secrets
Click New client secret
Choose a name for this secret and create it
Copy the secret value to your CleanSpeak OpenID Settings
Click save