Quick start: Set up OpenID Connect in the GAS

Follow these steps to quickly set up OpenID Connect for your Genero Application Server and Genero Web applications.

Before you begin, you must Configure GAS for OpenID Connect SSO.

In this quick start, you add OpenID Connect Single sign-on (SSO) to a Genero Browser Client application, then execute the application with SSO.

  1. Add OpenID Connect SSO to a Genero Web Client application requiring SSO.
    1. Add the DELEGATE element to all Genero Web applications requiring SSO

      The first three parameters are mandatory:

      • IDP: the provider of the IdP account (for example, https://accounts.google.com)
      • CLIENT_PUBLIC_ID: the OAuth2 public ID provided by the IdP
      • CLIENT_SECRET_ID: the OAuth2 shared secret ID provided by the IdP
      • SCOPE: (optional) the OpenID Connect attributes you want to get from the user at time of authentication (for example, email, phone, address).
      <APPLICATION Parent="defaultgwc">
            <EXECUTION>
              <PATH>$(res.path.mypath)/myapplication</PATH>
              <MODULE> myapp.42r</MODULE>
              <DELEGATE service="services/OpenIDConnectServiceProvider">
                <IDP>https://accounts.google.com</IDP>        
                <SCOPE>email</SCOPE>        
                <CLIENT_PUBLIC_ID>XXXXXXXX.apps.googleusercontent.com</CLIENT_PUBLIC_ID>
                <CLIENT_SECRET_ID>XXXXXX-XXXXXX</CLIENT_SECRET_ID>        
              </DELEGATE>
            </EXECUTION>
          </APPLICATION>        
  2. Execute a Genero Browser Client application with SSO.
    1. Start your browser and enter the application URL.
      You are prompted to enter your OpenID Connect credentials.
    2. Click the signin button.
      Your browser is redirected to the Identity Provider (IdP).
    3. Enter your credentials.
      If your credentials are valid, your browser is redirected to the Genero Browser Client application. The application can then get OpenID Connect user information through environment variables such as OIDC_SUB.
      Note: The fglrun process is executed in the context of the GAS operating system user. For example, when using Apache, the program process will run in the context of the Apache user.

The next time you start the same application - or any application delivered by the same Genero Application Server - you will not be prompted for your credentials. The application will start and be authenticated by the same OpenID Connect user.

Tip: Read all of the OpenID Connect topics in the Genero Application Server User Guide for details on features provided by OpenID Connect SSO support in the Genero Application Server; including attributes gathering or authorization control.