Share this page

# Implement OpenID Connect with PPM Center

This section provides information on how to implement OpenID Connect single sign-on (OICD SSO) with OpenText PPM.

## Setting up OICD SSO with PPM

1. Register PPM as Relaying Party (RP) in OpenID Provider (OP) with parameters:

   Callback URI: <PPM_BASE_URL>/itg/web/sso/oidc_callback.jsp

   Post Logout URI: <PPM_BASE_URL>/itg/web/sso/loggedout.jsp

   Remember the oAuth Client Key and oAuth Client Secret

2. Edit the PPM server.conf file as follows:

   Add or change

   `com.kintana.core.server.SINGLE_SIGN_ON_PLUGIN=com.kintana.sc.security.auth.OIDCSingleSignOn`

3. Edit <PPM_HOME>/integration/sso/oidc_sso.conf:

   1. Add `discovery_file=<path to OP metadata file>` or `discovery_uri=<URI of OP metadata file>`
   2. Add `client_id=<oAuth Client Key for PPM>`
   3. If PPM cannot access OP directly, configure the proxy: `proxy=<proxy_dns or proxy_ip>:<proxy_port>`

   4. If OP uses self-signed certification for https, add: `disable_ssl=true`

      Only use this option in development or test environments. Never use it in a production environment.
4. Restart PPM user instances.

## Troubleshooting

- To troubleshoot SSO, check the <ppm_server>/log/serverLog.txt file.

- For more debug information, in <PPM_HOME>/conf/logging.conf:

  Set `com.kintana.core.logging.SYSTEM_THRESHOLD = DEBUG`

  Add `com.kintana.core.logging.PRODUCT_FUNCTION_LOGGING_LEVEL = com.kintana.sc.authentication, DEBUG`

## Advanced Configuration

You can override the default settings or parameters for RP metadata in the oidc_sso.conf file:

Override OP metadata in discovery_file or discovery_uri (see above):

Parameter name | Description
--- | ---
issuer | The issuer identifier for the OpenID Provider.
authorization_endpoint | The authorization endpoint is the endpoint on the authorization server where the resource owner logs in, and grants authorization to the client application.
token_endpoint | The token endpoint is the endpoint on the authorization server where the client application exchanges the authorization code, client ID and client secret, for an id token.
jwks_uri | Jwks_uri is a metadata entry expressed as a URI for the OpenID Connect Identity Provider (IDP)'s JWK Set which contains a JSONArray of the JSON Web Keys (JWK) used for JSON Web Signature. If empty, id token’s signatures are not verified.
end_session_endpoint | The end session endpoint can be used to trigger single sign-out. If empty, sign-out is disabled.

Override default settings:

Parameter name | Description
--- | ---
flow | Allowed Values: AUTHORIZATION CODE or IMPLICIT Default value: PPM automatically choose the most appropriate flow.
audience | The audience of ID Token issued by OP. Default value: aAuth Client ID of PPM Application.
user_id_claim | The claim in ID Token used for user id in PPM. Default Value: sub
leeway | Specify a leeway window in which the ID Token should still be considered valid. Default Value: 0
post_logout_redirect_uri | The redirect URI after OP successfully logs out Default Value: <PPM_BASE_URL>/itg/sso/loggedout.jsp
token_endpoint_auth_method | The authentication method when the client application (PPM) exchanges the authorization code, client ID and client secret, for an id token from OP token endpoint. Allowed values: client_secret_basic or client_secret_post Default value: client_secret_basic

## Limitations

- Only AUTHORIZATION CODE flow or IMPLICIT flow are supported.
- token_endpoint_auth_method can only be either `client_secret_basic` or `client_secret_post`

https://admhelp.microfocus.com PPM 8942
Tips to improve your search results... OpenText™ Project and Portfolio Management Help Center PPM Help 26.2-26.3 All View Local Help Center View Online Help Center Version: