Identity Providers

The Identity Providers option lets you configure Identity Providers to enable single sign-on. After you have configured and enabled an Identity Provider, a button for that Identity Provider is displayed on the JAMS Web Client Log in screen.

Identity Providers screen

The Identity Provider screen lists all existing Identity Providers. You can also add, modify, enable/disable, or delete Identity Providers from this page. The following information is listed:

• Scheme - The unique name for registering the Identity Provider, such as azuread. The scheme must only contain letters, numbers, an underscore, or a hyphen. Also, it must always start with a letter.
• Display Name - This text is displayed on the button on the login screen for the JAMS Web Client. Up to 25 characters can be entered. They are displayed as uppercase letters.
• Provider - The type of Identity Provider.
• Enabled - A checkmark indicates the Identity Provider is enabled and is available as a button on the JAMS Web Client Log in screen. You can disable an Identity Provider, so it is saved but not used as the active login method.
• Actions - An additional menu that lets you modify the Identity Provider configuration.

Permissions

To work with Identity Providers, you need the following ACLs:

• Configuration - Execute: Required for creating, updating, deleting, enabling/disabling an Identity Provider.
• Configuration - Inquire: Required for viewing an Identity Provider.

Adding an Identity Provider

You can have only one OIDC and one SAML2 Identity Provider enabled at one time. However, you can have both an Identity Provider and User Federation configured and used simultaneously.

Adding an Identity Provider involves steps within and outside the JAMS Web Client. See the links below for two examples.

To configure single sign-on, see the links below:

• Configuring Single Sign-On with Azure Entra ID
• Configuring Single Sign-On with Azure Entra ID (SAML)
• Configuring Single Sign-On with Okta

Enabling or Disabling an Identity Provider

You can have multiple Identity Providers configured, but only one OIDC and one SAML2 Identity Provider can be enabled and used at a time. You may need to enable or disable configured Identity Providers.

After you enable an Identity Provider, you cannot edit it until you disable it.

1. Click Access from the main menu.

2. Click Identity Providers.

3. Do one of the following to edit the Identity Provider:

   • Click the name of the Identity Provider that you want to modify.
   • Click the row containing the Identity Provider and then select Properties.
   • Click a row in the table, click the under the Actions column, and select Properties.

4. On the Summary tab, click ENABLE or DISABLE in the top right corner of the table. If you are enabling an Identity Provider, a message is displayed prompting you to restart the Identity Service for this change to take effect. Complete the remaining steps to restart this service.
   

5. Log out of the JAMS Web Client.

6. Open the Windows Services manager.

7. Right-click the JAMS Identity service and select Restart.

8. Refresh the JAMS Web Client Log in screen.

9. Log in to the JAMS Web Client.

Modifying an Identity Provider

To change the properties on an Identity Provider, you must first disable it in the JAMS Web Client.

1. Click Access from the main menu.

2. Click Identity Providers.

3. Do one of the following to edit the Identity Provider:

   • Click the name of the Identity Provider that you want to modify.
   • Click the row containing the Identity Provider and then select Properties.
   • Click a row in the table, click the under the Actions column, and select Properties.

4. On the Summary tab, click DISABLE in the top right corner of the table.

5. Make any modifications.

6. Click Save.

7. Click ENABLE in the top right corner of the table, if you want to make this Identity Provider active. A message is displayed prompting you to restart the Identity Service for this change to take effect. Complete the remaining steps to restart this service.
   

8. Log out of the JAMS Web Client.

9. Open the Windows Services manager.

10. Right-click the JAMS Identity service and select Restart.

11. Refresh the JAMS Web Client Log in screen.

12. Log in to the JAMS Web Client.

Deleting an Identity Provider

1. Click Access from the main menu.

2. Click Identity Providers.

3. Do one of the following to delete the Identity Provider:

   • Click the row containing the Identity Provider and then select Delete.
   • Click a row in the table, click the under the Actions column, and select Delete.

4. When you are prompted to confirm the deletion, click Delete.

Identity Provider Tabs

The table below lists the available options for the Identity Providers. The options will vary depending on if you are using OIDC or SAML2. These fields are noted below.

Summary Tab	Description
Scheme	The unique name for registering the Identity Provider, such as azuread. The scheme must only contain letters, numbers, an underscore, or a hyphen. Also, it must always start with a letter. The scheme is set from Redirect URL (for OIDC) and Reply URL (for SAML2) in your Identity Provider application. For example, the default URLs are shown below with the scheme: OIDC - https://localhost:443/signin/scheme SAML2 - https://localhost:443/saml2/scheme/Acs
Display Name	This property sets the button text for this option on the JAMS Web Client Log in screen.
Enabled/Disabled	This icon shows if the Identity Provider is currently enabled and used for authentication. Use the ENABLE or DISABLE option in the top right corner of the table to enable or disable an Identity Provider. A checkmark is displayed if the Identity Provider is enabled and it is empty when disabled. : Enabled : Disabled If you are enabling an Identity Provider, a message is displayed prompting you to restart the JAMS Identity Service for this change to take effect.
Provider	This property displays the selected Identity Provider, such as Microsoft Entra ID via OpenID Connect.

OIDC Options
Callback URL	This is a read-only property that shows the Callback URL that is a combination of the GatewayURL/signin/{scheme} values.
Authority	The OIDC Authority URL is the address of the Identity Provider. For example, it may look similar to: https://login.microsoftonline.com/1234a567-8b91-c123-4d56-7891e1234f1
Client ID	The OIDC Client ID is the Application (client) ID assigned to the registered client application. This is typically visible in your Identity Provider's admin console area when you configure an application. For example, it may look similar to:12345678-1234-1234-1234-123456789abc. Note: After you add the Client ID, you need to click Save before adding the Client Secret value.
Client Secret	The OIDC Client Secret is the password for your registered client application. For example, in Azure, this is listed as the Secret Value from the Value column. This is typically visible in your Identity Provider's admin console area when you configure an application. For example, it may look similar to: 1234a~5678B901234c5678d901234e5~67890123
Management Client ID (Okta only)	The Management Client ID is the Client ID created as part of the API application in the Okta Admin Console.
Management Key Pair (Okta only)	The Management Key Pair option is the RSA key pair for the Okta integration. It creates a public JWK that you use to register on the Okta Admin Console.

SAML2 Options
ACS URL	This is a read-only property that shows the ACS URL that is a combination of the GatewayURL/saml2/{scheme}/Asc values.
IdP Entity ID	The IdP Entity ID is the unique ID for the Identity Provider. It is often a URL. For example, it may look similar to: https://sts.windows.net/12341234-1234-1234-5678-90123456789a/
Metadata URL	The Metadata URL is a link that points to an XML file for configuring single sign-on. For example, it may look similar to: https://login.microsoftonline.com/12341234-5678-9012-3456-7890ab123456/federationmetadata/2007-06/federationmetadata.xml?appid=12341234-a567-b890-c1234-d4567890c421