Define the OpenID Connect Provider in B2C Service

You use the OIDC Providers editor in B2C Service to enter information about OpenID Connect external identity providers.

Before you start

This procedure assumes that:

• You have added the Single Sign-On Configurations component to the configuration list for the Configuration button. See Create a Navigation Set for the Administrator.
• You have enabled the hidden configuration setting SSO_ENABLE_EXTERNAL_IDP. This setting is not enabled by default. You can enable this setting using B2C Service Configuration Assistant. For more information, refer Single Sign-On Configuration.

Here's what to do

1. In the Agent Browser UI, click the Navigation Menu icon, then select Single Sign-On Configurations.
2. Click New on the toolbar.
   The New OpenID Connect Provider editor displays.
3. Enter field information.

   New OpenID Connect Provider Editor

   Field	Description
   Provider Entity ID	Enter a unique name for the OpenID Connect (OIDC) provider in this field.
   Active	Select this check box to enable the OIDC provider.
   Authorization Endpoint	The URL on the OIDC provider for requesting authorization code
   Token Endpoint	The URL on the OIDC provider for requesting ID token
   Client ID	Unique ID assigned to B2C Service by the OIDC provider
   Client Secret	Confidential key assigned to Oracle Service Cloud by the OIDC provider
   Scope	openid
   ID Token Provider	Click the vertical three-dot menu, and click Add New to add a new Identity Provider.
   Web SSO	Select this check box to make the OIDC provider the default external identity provider. Note: Only one active identity provider can be enabled for Web SSO (across both the SAML and OIDC protocols).
   Subject Type	Click the drop-down list and select the subject type used in the ID token. The options are Email, Login Name, and Account ID. The default value is Login Name.
   Logout URL	The URL on the OIDC provider for sending logout requests/responses
   Token Validity	Enter the number of seconds that the timestamp on ID tokens will be accepted. This takes precedence over the timestamp on ID tokens.
   Certificates	Click the arrow next to Certificates to expand this section. Click the Choose file next to the Import Certificate field to select the location of the certificate you want to use to validate ID tokens received from the OIDC provider. The certificate populates in the Certificate field. You can also specify an alternate certificate to use when validation fails using the primary certificate. You can click the X Delete icon to delete the certificate. Certificates can be deleted if there is more than one certificate configured for the IdP or if the IdP is inactive.

   Note: If the certificate used to sign the ID token is self-signed, it must be uploaded to the Additional Root Certificates (certs/root) directory in the File Manager. See Manage Files with the File Manager.